WordPress 3.8.1 /xmlrpc.php 文件有ping其他主机的功能，通过这个功能可以请求多个站点，DDOS攻击别的网站。
1. wordpress Pingback 漏洞的发现
早在2012 年 12 月 17 日一些采用 PHP 的知名博客程序 WordPress被曝光存在严重的漏洞，该漏洞覆盖WordPress 全部已发布的版本（包括WordPress 3.8.1）。该漏洞的 WordPress 扫描工具也在很多论坛和网站发布出来。工具可以利用 WordPress 漏洞来进行扫描，也可以发起DDoS 攻击。经过测试，漏洞影响存在 xmlrpc.php 文件的全部版本。
2. 漏洞的利用原理
Pingback 是三种类型的反向链接中的一种，当有人链接或者盗用作者文章时来通知作者的一种方法。可以让作者了解和跟踪文章被链接或被转载的情况。一些全球最受欢迎的 blog 系统比如 Movable Type、Serendipity、WordPress 和 Telligent Community 等等，都支持 Pingback 功能，使得可以当自己的文章被转载发布的时候能够得到通知。 WordPress 中有一个可以通过 xmlrpc.php 文件接入的 XMLRPC API，可以使用 pingback.ping 的方法加以利用。 其他 BLOG 网站向 WordPress 网站发出 pingback，当WordPress处理 pingback 时，会尝试解析源 URL。如果解析成功，将会向该源 URL 发送一个请求，并检查响应包中是否有本 WordPress 文章的链接。如果找到了这样一个链接，将在这个博客上发一个评论，告诉大家原始文章在自己的博客上。 黑客向使用WordPress论坛的网站发送数据包，带有被攻击目标的 URL（源 URL）。WordPress 论坛网站收到数据包后，通过 xmlrpc.php 文件调用 XMLRPC API,向被攻击目标 URL 发起验证请求。如果发出大量的请求，就会对目标 URL 形成 HTTP Flood。当然，单纯向 WordPress 论坛网站发出大量的请求，也会导致 WordPress 网站自身被攻瘫。 除了 DDoS 之外，黑客可以通过源 URL 主机存在与否将返回不同的错误信息这个线索，如果这些主机在内网中确实存在，攻击者可以进行内网主机扫描。
利用wordpress XMLRPC攻击的示例：
$ curl -D - "www.abc.com/xmlrpc.php" -d '<methodCall><methodName>pingback.ping</methodName><params><param><value><string>http://www.baidu.com</string></value></param><param><value><string>www.bac.com/postchosen</string></value></param></params></methodCall>'
预防方法：删除xmlrpc.php文件或者禁止对xmlrpc.php文件的访问。
转自：http://www.v7v3.com/wpzixun/2014031103.html
Distributed Denial of Service (DDOS) attacks are becoming a common trend on our blog lately, and that’s OK because it’s a very serious issue for every website owner. Today I want to talk about a large DDOS attack that leveraged thousands of unsuspecting WordPress websites as indirect source amplification vectors.
Any WordPress site with Pingback enabled (which is on by default) can be used in DDOS attacks against other sites. Note that XMLRPC is used for pingbacks, trackbacks, remote access via mobile devices and many other features you’re likely very fond of. But, it can also be heavily misused like what we are seeing.
The story
It all happened against a popular WordPress site that had gone down for many hours due to a DDOS. As the attack increased in size, their host shut them down, and then they decided to ask for help and subscribed to our CloudProxy Website Firewall.
Once the DNS was ported we were able to see what was going on, it was a large HTTP-based (layer 7) distributed flood attack, sending hundreds of requests per second to their server. The requests looked like this:
74.86.132.186 - - [09/Mar/2014:11:05:27 -0400] "GET /?4137049=6431829 HTTP/1.0" 403 0 "-" "WordPress/3.8; http://www.mtbgearreview.com" 121.127.254.2 - - [09/Mar/2014:11:05:27 -0400] "GET /?4758117=5073922 HTTP/1.0" 403 0 "-" "WordPress/3.4.2; http://www.kschunvmo.com" 217.160.253.21 - - [09/Mar/2014:11:05:27 -0400] "GET /?7190851=6824134 HTTP/1.0" 403 0 "-" "WordPress/3.8.1; http://www.intoxzone.fr" 193.197.34.216 - - [09/Mar/2014:11:05:27 -0400] "GET /?3162504=9747583 HTTP/1.0" 403 0 "-" "WordPress/2.9.2; http://www.verwaltungmodern.de" ..
If you notice, all queries had a random value (like “?4137049=643182″) that bypassed their cache and force a full page reload every single time. It was killing their server pretty quickly.
But the most interesting part is that all the requests were coming from valid and legitimate WordPress sites. Yes, other WordPress sites were sending that random requests at a very large scale and bringing the site down.
WordPress Insecure Default Option = Very Large Botnet
Just in the course of a few hours, over 162,000 different and legitimate WordPress sites tried to attack his site. We would likely have detected a lot more sites, but we decided we had seen enough and blocked the requests at the edge firewall, mostly to avoid filling the logs with junk.
Can you see how powerful it can be? One attacker can use thousands of popular and clean WordPress sites to perform their DDOS attack, while being hidden in the shadows, and that all happens with a simple ping back request to the XML-RPC file:
$ curl -D - "www.anywordpresssite.com/xmlrpc.php" -d '<methodCall><methodName>pingback.ping</methodName><params><param><value><string>http://victim.com</string></value></param><param><value><string>www.anywordpresssite.com/postchosen</string></value></param></params></methodCall>'
Yes, that simple command on Linux can start it all.
Is your site attacking others?
It might be and you have no idea. To verify, look through your logs for any POST requests to the XML-RPC file, similar to the one below. If you see a pingback to a random URL, you know your site is being misused.
93.174.93.72 - - [09/Mar/2014:20:11:34 -0400] "POST /xmlrpc.php HTTP/1.0" 403 4034 "-" "-" "POSTREQUEST:<?xml version=\x221.0\x22 encoding=\x22iso-8859-1\x22?>\x0A<methodCall>\x0A<methodName>pingback.ping</methodName>\x0A<params>\x0A <param>\x0A <value>\x0A <string>http://fastbet99.com/?1698491=8940641</string>\x0A </value>\x0A </param>\x0A <param>\x0A <value>\x0A <string>yoursite.com</string>\x0A </value>\x0A </param>\x0A</params>\x0A</methodCall>\x0A" 94.102.63.238 – - [09/Mar/2014:23:21:01 -0400] "POST /xmlrpc.php HTTP/1.0" 403 4034 "-" "-" "POSTREQUEST:\x0A\x0Apingback.ping\x0A\x0A \x0A \x0A http://www.guttercleanerlondon.co.uk/?7964015=3863899\x0A \x0A \x0A \x0A \x0A yoursite.com\x0A \x0A \x0A\x0A\x0A"
In these cases above, someone tried to use one of our honeypots to DDOS fastbet99.com and guttercleanerlondon.co.uk (a site we don’t know or service).
To stop your WordPress website from being misused, you will need to disable the XML-RPC (pingback) functionality on your site. You can do this by removing the file, xmlrpc.php, or you can disable notifications in your settings. The biggest challenge you’ll find with removing the file is that on an update it’ll come right back, annoying, I know. Some preliminary tests are showing that we’re able to bypass the disable notification setting but we are still investigating.
Update: A better way to block it is by creating a plugin that adds the following filter:
add_filter( ‘xmlrpc_methods’, function( $methods ) {
unset( $methods[‘pingback.ping’] );
return $methods;
} );
This is a well known issue within WordPress and the core team is aware of it, it’s not something that will be patched though. In many cases this same issue is categorized as a feature, one that many plugins use, so in there lies the dilemma.
Online Tool to Check if your site was misused
Because of how prevalent an issue this is becoming, we’ve put together a little scanner that will check if your website has shown up in our logs. This scanner is only looking to see if your site has used to attack anyone within our network.
Use our WordPress DDOS Scanner to check if your site is DDOS’ing other websites.
转自：http://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-for-distributed-denial-of-service-attack.html