{"id":984,"date":"2014-09-16T01:49:36","date_gmt":"2014-09-15T16:49:36","guid":{"rendered":"http:\/\/tech.akat.info\/?p=984"},"modified":"2014-09-16T02:09:34","modified_gmt":"2014-09-15T17:09:34","slug":"pingbackddos%e6%94%bb%e6%92%83%e5%af%be%e7%ad%96","status":"publish","type":"post","link":"https:\/\/tech.akat.info\/?p=984","title":{"rendered":"PingbackDDoS\u653b\u6483\u5bfe\u7b56"},"content":{"rendered":"

\u6982\u8981<\/h1>\n

\u5148\u65e5dos\u5bfe\u7b56<\/a>\u3057\u305f\u304c\u3001xmlrpc.php\u306e\u8106\u5f31\u6027\u3092\u72d9\u3063\u305f\u3082\u306e\u3067\u3042\u3063\u305f\u305f\u3081\u5bfe\u7b56\u3057\u305f
\n\u3053\u308c\u306f\u3001WordPress\u306ePingback\u6a5f\u80fd\u3092\u5229\u7528\u3057\u3066\u3001WordPress\u304c\u7a3c\u50cd\u3057\u3066\u3044\u308bWeb\u30b5\u30fc\u30d0\u306bPingback\u901a\u77e5\u3092\u9001\u4fe1\u3059\u308b\u653b\u6483\u3092\u3057\u304b\u3051\u3001\u3055\u3089\u306b\u305d\u306e\u5148\u306e\u653b\u6483\u5bfe\u8c61\u3068\u306a\u308b\u30b5\u30fc\u30d0\u3092DDoS\u72b6\u614b\u306b\u9665\u3089\u305b\u308b
\n\u203bPingback\u6a5f\u80fd\u3068\u306f\u3001XML-RPC\u306e\u6a5f\u80fd\u306e\u3072\u3068\u3064\u3067\u3001\u81ea\u5206\u306e\u30b5\u30a4\u30c8\u306b\u4ed6\u30b5\u30a4\u30c8\u3078\u306e\u30ea\u30f3\u30af\u3092\u5f35\u3063\u305f\u969b\u3001\u30ea\u30f3\u30af\u5148\u306e\u30b5\u30a4\u30c8\u3078\u81ea\u52d5\u7684\u306b\u901a\u77e5\u3059\u308b\u6a5f\u80fd
\n\u203bXML-RPC\u306fWordpress Ver.3.5\u304b\u3089\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u8a2d\u5b9a\u3067\u6709\u52b9\u5316<\/p>\n

\r\n195.154.127.19 - - [15\/Sep\/2014:10:41:44 +0000] "POST \/xmlrpc.php HTTP\/1.0" 502 568 "-" "Mozilla\/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"\r\n195.154.127.19 - - [15\/Sep\/2014:10:41:47 +0000] "POST \/xmlrpc.php HTTP\/1.0" 502 568 "-" "Mozilla\/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"\r\n195.154.127.19 - - [15\/Sep\/2014:10:41:50 +0000] "POST \/xmlrpc.php HTTP\/1.0" 502 568 "-" "Mozilla\/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"\r\n195.154.127.19 - - [15\/Sep\/2014:10:41:51 +0000] "POST \/xmlrpc.php HTTP\/1.0" 502 568 "-" "Mozilla\/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"\r\n195.154.127.19 - - [15\/Sep\/2014:10:41:53 +0000] "POST \/xmlrpc.php HTTP\/1.0" 502 568 "-" "Mozilla\/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"\r\n<\/pre>\n
\u8e0f\u307f\u53f0\u306b\u3055\u308c\u3066\u3044\u306a\u3044\u304b\u3001\u78ba\u8a8d\u65b9\u6cd5<\/h1>\n
Securi\u30b5\u30a4\u30c8\u304b\u3089<\/h2>\n
Securi\u304c\u4fdd\u6709\u3059\u308b\u30ed\u30b0\u304b\u3089\u904e\u53bb\u653b\u6483\u304c\u884c\u308f\u308c\u305f\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3067\u304d\u308b<\/a>
\n\"2014-09-16_015605\"<\/a><\/p>\n
curl\u3092\u5229\u7528<\/h2>\n
\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u30ec\u30b9\u30dd\u30f3\u30b9\u304c\u8fd4\u3063\u3066\u304d\u305f\u3089\u5371\u967a\u3089\u3057\u3044<\/p>\n
\r\nroot@hostname:\/home\/admin# curl -d '<?xml version="1.0"?><methodCall><methodName>pingback.ping<\/methodName><\/methodCall>' http:\/\/tech.akat.info\/xmlrpc.php\r\n<?xml version="1.0" encoding="UTF-8"?>\r\n<methodResponse>\r\n  <fault>\r\n    <value>\r\n      <struct>\r\n        <member>\r\n          <name>faultCode<\/name>\r\n          <value><int>0<\/int><\/value>\r\n        <\/member>\r\n        <member>\r\n          <name>faultString<\/name>\r\n          <value><string><\/string><\/value>\r\n        <\/member>\r\n      <\/struct>\r\n    <\/value>\r\n  <\/fault>\r\n<\/methodResponse>\r\n<\/pre>\n
\u5bfe\u5fdc\u65b9\u6cd5<\/h1>\n
Pingback\u6a5f\u80fd\u3092\u7121\u52b9\u306b\u3059\u308b<\/h2>\n
[\u8a2d\u5b9a]\u2192[\u30c7\u30a3\u30b9\u30ab\u30c3\u30b7\u30e7\u30f3]\u3088\u308a[\u4ed6\u306e\u30d6\u30ed\u30b0\u304b\u3089\u306e\u901a\u77e5 (\u30d4\u30f3\u30d0\u30c3\u30af\u30fb\u30c8\u30e9\u30c3\u30af\u30d0\u30c3\u30af) \u3092\u53d7\u3051\u4ed8\u3051\u308b]\u306e\u30c1\u30a7\u30c3\u30af\u3092\u5916\u3059
\n\u5229\u7528\u3057\u3066\u3044\u306a\u3044[\u3053\u306e\u6295\u7a3f\u306b\u542b\u307e\u308c\u308b\u3059\u3079\u3066\u306e\u30ea\u30f3\u30af\u3078\u306e\u901a\u77e5\u3092\u8a66\u307f\u308b]\u306e\u30c1\u30a7\u30c3\u30af\u3082\u5916\u3057\u305f
\n\"2014-09-16_000935\"<\/a><\/p>\n
\u904e\u53bb\u306e\u6295\u7a3f\u306b\u3064\u3044\u3066\u3082\u7121\u52b9\u306b\u3059\u308b\u3001[\u7de8\u96c6]\u3092\u9078\u629e\u3057[\u9069\u7528]\u3059\u308b
\n\"2014-09-16_010958\"<\/a>\"2014-09-16_011217\"<\/a><\/p>\n
XMLRPC\u3092\u7121\u52b9\u306b\u3059\u308b<\/h2>\n
XMLRPC\u306fPingback\u6a5f\u80fd\u4ee5\u5916\u306b\u30ea\u30e2\u30fc\u30c8\u6295\u7a3f\u306a\u3069\u306b\u5229\u7528\u3055\u308c\u3066\u3044\u308b
\n\u5229\u7528\u3057\u306a\u3051\u308c\u3070\u7121\u52b9\u306b\u3059\u308b\u3053\u3068\u304c\u4e00\u756a\u3001\u4ee5\u4e0b\u306e\u8a2d\u5b9a\u3092nginx\u306b\u57cb\u3081\u8fbc\u3093\u3060<\/p>\n
\r\nlocation = \/xmlrpc.php {\r\ndeny all;\r\n}\r\n<\/pre>\n
\u53c2\u8003URL<\/h1>\n
WordPress\u306e\u8106\u5f31\u6027\u3092\u3064\u3044\u305f\u653b\u6483\u304c\u518d\u71c3\u3057\u3066\u3044\u307e\u3059\u3002
\nhttp:\/\/www.denet.ad.jp\/news\/2014\/08\/wordpress.html<\/p>\n
Pingback\u4ed5\u69d8
\nhttp:\/\/www.hixie.ch\/specs\/pingback\/translations\/pingback-1.0.jp<\/p>\n
\u4eca\u5ea6\u306fWordPress\u304c\u8e0f\u307f\u53f0\u306b\u3001Pingback\u6a5f\u80fd\u3092\u60aa\u7528\u3057DDoS\u653b\u6483
\nhttp:\/\/www.atmarkit.co.jp\/ait\/articles\/1403\/13\/news133.html<\/p>\n
WordPress\u306epingback\u6a5f\u80fd\u3092\u60aa\u7528\u3059\u308bDoS\u306b\u5bfe\u5fdc\u3057\u3088\u3046
\nhttp:\/\/chonan.blog.pid0.org\/2014\/03\/wordpresspingbackdos.html<\/p>\n
WordPress\u306ePingback\u6a5f\u80fd\u3092\u60aa\u7528\u3057\u305f\u653b\u6483\u5bfe\u7b56\u306b\u3064\u3044\u3066
\nhttp:\/\/faq.nttpc.co.jp\/faq\/show\/6800?site_domain=suitex<\/p>\n","protected":false},"excerpt":{"rendered":"
\u6982\u8981 \u5148\u65e5dos\u5bfe\u7b56\u3057\u305f\u304c\u3001xmlrpc.php\u306e\u8106\u5f31\u6027\u3092\u72d9\u3063\u305f\u3082\u306e\u3067\u3042\u3063\u305f\u305f\u3081\u5bfe\u7b56\u3057\u305f \u3053\u308c\u306f\u3001WordPress\u306ePingback\u6a5f\u80fd\u3092\u5229\u7528\u3057\u3066\u3001WordPress\u304c\u7a3c\u50cd\u3057\u3066\u3044\u308bWeb\u30b5\u30fc\u30d0\u306bPingback\u901a\u77e5\u3092\u9001 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[12,37],"tags":[],"_links":{"self":[{"href":"https:\/\/tech.akat.info\/index.php?rest_route=\/wp\/v2\/posts\/984"}],"collection":[{"href":"https:\/\/tech.akat.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tech.akat.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tech.akat.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tech.akat.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=984"}],"version-history":[{"count":7,"href":"https:\/\/tech.akat.info\/index.php?rest_route=\/wp\/v2\/posts\/984\/revisions"}],"predecessor-version":[{"id":995,"href":"https:\/\/tech.akat.info\/index.php?rest_route=\/wp\/v2\/posts\/984\/revisions\/995"}],"wp:attachment":[{"href":"https:\/\/tech.akat.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=984"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tech.akat.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=984"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tech.akat.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}