{"id":114,"date":"2022-05-09T20:56:55","date_gmt":"2022-05-09T12:56:55","guid":{"rendered":"https:\/\/frogvps.com\/?p=114"},"modified":"2022-05-19T08:23:17","modified_gmt":"2022-05-19T00:23:17","slug":"%e5%a6%82%e4%bd%95%e7%a6%81%e7%94%a8xmlrpc-php%e9%98%b2%e6%ad%a2%e7%bd%91%e7%ab%99%e8%a2%ab%e6%9a%b4%e5%8a%9b%e7%a0%b4%e8%a7%a3","status":"publish","type":"post","link":"https:\/\/frogvps.com\/?p=114","title":{"rendered":"\u5982\u4f55\u7981\u7528xmlrpc.php\u9632\u6b62\u7f51\u7ad9\u88ab\u66b4\u529b\u7834\u89e3"},"content":{"rendered":"\n<p>XML-RPC \u662f\u4e00\u79cd\u80fd\u591f\u5728 WordPress \u548c\u5176\u4ed6\u7cfb\u7edf\u4e4b\u95f4\u8fdb\u884c\u901a\u4fe1\u7684\u89c4\u8303\u3002\u65e9\u671f\u5b83\u88ab\u7528\u4e8e\u548c\u5176\u4ed6\u535a\u5ba2\u5e73\u53f0\u4e4b\u95f4\u7684\u901a\u8baf\uff0c\u652f\u6301trackbacks\u548cpingbacks\u3002\u867d\u7136\u73b0\u5728\u5df2\u7ecf\u8fc7\u65f6\u4e86\uff0c\u4f46\u662f\u6839\u76ee\u5f55\u7684xmlrpc.php\u6587\u4ef6\u4ecd\u7136\u5b58\u5728\u3002\u9ed1\u5ba2\u53ef\u80fd\u4f1a\u5229\u7528\u8fd9\u4e2a\u6587\u4ef6\uff0c\u5bf9\u6211\u4eec\u7684\u7f51\u7ad9\u53d1\u8d77DDOS\u653b\u51fb\u548c\u5bc6\u7801\u7206\u7834\u3002\u6240\u4ee5\u4e3a\u4e86\u5b89\u5168\u8d77\u89c1\uff0c\u6700\u597d\u7981\u6b62\u6240\u6709\u7684\u7528\u6237\u8bbf\u95ee\u8fd9\u4e2a\u6587\u4ef6\u3002<\/p>\n\n\n\n<p>\u4e4b\u524d\u89c2\u5bdf\u7f51\u7ad9\u65e5\u5fd7\u7684\u65f6\u5019\uff0c\u8fd8\u771f\u7684\u53d1\u73b0\u6709\u4e2a\u65e0\u804a\u7684\u4eba\u5728\u90a3\u91cc\u4e0d\u505c\u7684\u53d1\u8d77\u4e0b\u9762\u8fd9\u79cdPOST\u8bf7\u6c42<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST \/\/xmlrpc.php HTTP\/1.1<\/code><\/pre>\n\n\n\n<p>\u4e0b\u9762\u6211\u4f1a\u4ecb\u7ecd\u76ee\u524d\u4e24\u79cd\u4e3b\u6d41\u7684web\u670d\u52a1\u5668\u5982\u4f55\u6765\u7981\u6b62\u7528\u6237\u8bbf\u95ee\u67d0\u4e2a\u7279\u5b9a\u7684\u8d44\u6e90<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Nginx<\/h2>\n\n\n\n<p>\u7531\u4e8e\u6211\u4f7f\u7528\u7684\u662fnginx\uff0c\u6240\u4ee5\u6211\u76f4\u63a5\u5728\u914d\u7f6e\u6587\u4ef6\u52a0\u4e86\u4e00\u6761location\u6307\u4ee4\u9650\u5236\u7528\u6237\u8bbf\u95ee\u8fd9\u4e2a\u6587\u4ef6<\/p>\n\n\n\n<p>\u62d2\u7edd\u6240\u6709\u4eba\u8bbf\u95ee\u7ed3\u5c3e\u5305\u542bxmlrpc.php\u7684\u6587\u4ef6<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code> &nbsp;  location ~ \/xmlrpc\\.php$ {<br> &nbsp; &nbsp; &nbsp;  deny all;<br> &nbsp;  }<br>\u200b<br>\u200b<br> &nbsp;  # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000<br>\u200b<br> &nbsp;  location ~ \\.php$ {<br> &nbsp; &nbsp; &nbsp;  root &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \/var\/www\/wordpress;<br> &nbsp; &nbsp; &nbsp;  fastcgi_pass &nbsp; 127.0.0.1:9000;<br> &nbsp; &nbsp; &nbsp;  fastcgi_index  index.php;<br> &nbsp; &nbsp; &nbsp;  fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;<br> &nbsp; &nbsp; &nbsp;  include &nbsp; &nbsp; &nbsp;  fastcgi_params;<br> &nbsp;  }<br>\u200b<\/code><\/pre>\n\n\n\n<p>\u8fd9\u91cc\u6709\u4e2a\u7ec6\u8282\u5c31\u662f\uff0c\u5f53location\u7684\u4f18\u5148\u7ea7\u76f8\u540c\u65f6\uff08\u90fd\u662f ~\uff09\uff0cnginx\u4f1a\u4ece\u4e0a\u5230\u4e0b\u8bfb\u53d6\u914d\u7f6e\u6587\u4ef6\u76f4\u5230\u5339\u914d\u5230\u7b26\u5408\u7684\u7ed3\u675f\u3002\u6240\u4ee5\u8fd9\u4e2a\u62d2\u7edd\u6307\u4ee4\u5fc5\u987b\u653e\u5728\u6211\u7684PHP\u53cd\u5411\u4ee3\u7406\u914d\u7f6e\u7684\u524d\u9762\uff0c\u5426\u5219\u7684\u8bdd\u5f53\u6709\u4eba\u8bf7\u6c42xmlrpc.php\u5b83\u4f1a\u4f18\u5148\u5339\u914d\u5230 .php\u7684location\u5757\u7136\u540e\u505c\u6b62\u7ee7\u7eed\u5339\u914d\u3002\u5982\u679c\u4f60\u4f7f\u7528\u7684\u662f\u201c=\u201d \u5c31\u4e0d\u5b58\u5728\u8fd9\u4e2a\u95ee\u9898\uff0c\u56e0\u4e3a=\u7684\u4f18\u5148\u7ea7\u6700\u9ad8\u3002<\/p>\n\n\n\n<p><strong>location\u7684\u5339\u914d\u4f18\u5148\u7ea7\u4ece\u9ad8\u5230\u4f4e<\/strong><\/p>\n\n\n\n<p>=, ^~, ~\/~*, \u4e0d\u5e26\u7b26\u53f7<\/p>\n\n\n\n<p>\u4fee\u6539\u5b8c\u914d\u7f6e\u6587\u4ef6\u540e\u91cd\u65b0\u52a0\u8f7d<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nginx -s reload<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"208\" src=\"https:\/\/frogvps.com\/wp-content\/uploads\/2022\/05\/20220509a1-1024x208.jpg\" alt=\"\" class=\"wp-image-214\" srcset=\"https:\/\/frogvps.com\/wp-content\/uploads\/2022\/05\/20220509a1-1024x208.jpg 1024w, https:\/\/frogvps.com\/wp-content\/uploads\/2022\/05\/20220509a1-300x61.jpg 300w, https:\/\/frogvps.com\/wp-content\/uploads\/2022\/05\/20220509a1-768x156.jpg 768w, https:\/\/frogvps.com\/wp-content\/uploads\/2022\/05\/20220509a1.jpg 1480w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>\u5728\u6d4f\u89c8\u5668\u6d4b\u8bd5\u4e00\u4e0b\u80fd\u4e0d\u80fd\u8bbf\u95ee\uff0c\u770b\u5230403 Forbidden\u5c31\u662f\u914d\u7f6e\u597d\u4e86<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Apache<\/h2>\n\n\n\n<p>\u53ea\u9700\u8981\u5728\u670d\u52a1\u5668\u914d\u7f6e\u6587\u4ef6\u91cc\u52a0\u4e0a\u8fd9\u53e5<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;Files \"xmlrpc.php\"&gt;<br>Require all denied<br>&lt;\/Files&gt;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"926\" height=\"453\" src=\"http:\/\/frogvps.com\/wp-content\/uploads\/2022\/05\/20220509a2.jpg\" alt=\"\" class=\"wp-image-212\" srcset=\"https:\/\/frogvps.com\/wp-content\/uploads\/2022\/05\/20220509a2.jpg 926w, https:\/\/frogvps.com\/wp-content\/uploads\/2022\/05\/20220509a2-300x147.jpg 300w, https:\/\/frogvps.com\/wp-content\/uploads\/2022\/05\/20220509a2-768x376.jpg 768w\" sizes=\"auto, (max-width: 926px) 100vw, 926px\" \/><figcaption>\u6d4b\u8bd5\u6548\u679c<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>XML-RPC \u662f\u4e00\u79cd\u80fd\u591f\u5728 WordPress \u548c\u5176\u4ed6\u7cfb\u7edf\u4e4b\u95f4\u8fdb\u884c\u901a\u4fe1\u7684\u89c4\u8303\u3002\u65e9\u671f\u5b83\u88ab\u7528\u4e8e\u548c\u5176\u4ed6\u535a\u5ba2\u5e73\u53f0\u4e4b\u95f4\u7684\u901a\u8baf\uff0c\u652f\u6301trackbacks\u548cpingbacks\u3002\u867d\u7136\u73b0\u5728\u5df2\u7ecf\u8fc7\u65f6\u4e86\uff0c\u4f46\u662f\u6839\u76ee\u5f55\u7684xmlrpc.php\u6587\u4ef6\u4ecd\u7136\u5b58\u5728\u3002\u9ed1\u5ba2\u53ef\u80fd\u4f1a&#8230;<\/p>\n","protected":false},"author":1,"featured_media":202,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[30,14,21],"topic":[],"class_list":["post-114","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-apache","tag-nginx","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/frogvps.com\/index.php?rest_route=\/wp\/v2\/posts\/114","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/frogvps.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/frogvps.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/frogvps.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/frogvps.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=114"}],"version-history":[{"count":6,"href":"https:\/\/frogvps.com\/index.php?rest_route=\/wp\/v2\/posts\/114\/revisions"}],"predecessor-version":[{"id":216,"href":"https:\/\/frogvps.com\/index.php?rest_route=\/wp\/v2\/posts\/114\/revisions\/216"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/frogvps.com\/index.php?rest_route=\/wp\/v2\/media\/202"}],"wp:attachment":[{"href":"https:\/\/frogvps.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/frogvps.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/frogvps.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=114"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/frogvps.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftopic&post=114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}