{"id":66071,"date":"2019-06-27T19:11:04","date_gmt":"2019-06-27T17:11:04","guid":{"rendered":"https:\/\/de.wordpress.org\/support\/topic\/server-ueber-xmlrpc-php-gehackt\/"},"modified":"2019-06-28T06:18:29","modified_gmt":"2019-06-28T04:18:29","slug":"server-ueber-xmlrpc-php-gehackt","status":"publish","type":"topic","link":"https:\/\/de.wordpress.org\/support\/topic\/server-ueber-xmlrpc-php-gehackt\/","title":{"rendered":"Server \u00fcber xmlrpc.php gehackt?"},"content":{"rendered":"

Hallo,<\/p>\n

gestern Morgen<\/p>\n

118.163.216.107 – – [26\/Jun\/2019:08:46:32 +0200] „POST \/xmlrpc.php HTTP\/1.1“ 200 4349 „-“ „xmlrpclib.py\/1.0.1 (by www.—-.com)“<\/p>\n

dann<\/p>\n

184.168.46.56 – – [26\/Jun\/2019:09:00:34 +0200] „GET \/wp-content\/themes\/saohovfqog\/bkevoxoksp.php HTTP\/1.0“ 200
\n93.125.99.46 – – [26\/Jun\/2019:09:00:39 +0200] „POST \/wp-content\/themes\/saohovfqog\/bkevoxoksp.php HTTP\/1.1“
\n…..
\n108.179.213.63 – – [26\/Jun\/2019:09:01:08 +0200] „POST \/wp-includes\/sodium_compat\/src\/Core\/XChaCha20.php HTTP\/1.0“<\/p>\n

innerhalb kurzer Zeit war der Server voll mit neuen oder ver\u00e4nderten Dateien.<\/p>\n

Vieles wird von Wordfence gefunden,
\ntwentynineteen -> .a67a0cd3.ico wird nicht angezeigt, obwohl der Code eher fragw\u00fcrdig ist<\/p>\n

$_ey6tb = basename\/*ujot*\/(\/*xd4fy*\/trim\/*y7g*\/(\/*rqa3*\/preg_replace\/*usiax*\/<\/code><\/p>\n

Sollte man xmlrpc.php abschalten oder braucht man das?<\/p>\n

Gr\u00fcsse Walter<\/p>\n","protected":false},"template":"","class_list":["post-66071","topic","type-topic","status-publish","hentry","topic-tag-xmlrpc-php"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/de.wordpress.org\/support\/wp-json\/wp\/v2\/topic\/66071","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/de.wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/de.wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/de.wordpress.org\/support\/wp-json\/wp\/v2\/topic\/66071\/revisions"}],"wp:attachment":[{"href":"https:\/\/de.wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=66071"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}