{"id":3156,"date":"2021-04-14T18:10:31","date_gmt":"2021-04-14T11:10:31","guid":{"rendered":"https:\/\/webvocuc.com\/blog\/?p=3156"},"modified":"2021-04-14T18:12:02","modified_gmt":"2021-04-14T11:12:02","slug":"cach-khac-phuc-website-worpress-bi-hack","status":"publish","type":"post","link":"https:\/\/webvocuc.com\/blog\/cach-khac-phuc-website-worpress-bi-hack.html","title":{"rendered":"C\u00e1ch kh\u1eafc ph\u1ee5c website Worpress b\u1ecb hack"},"content":{"rendered":"

C\u00e1ch kh\u1eafc ph\u1ee5c website Worpress b\u1ecb hack<\/a>. B\u00e0i vi\u1ebft n\u00e0y cung c\u1ea5p m\u1ed9t s\u1ed1 c\u00f4ng c\u1ee5 m\u00e0 b\u1ea1n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng \u0111\u1ec3 gi\u00fap l\u00e0m s\u1ea1ch trang web c\u1ee7a b\u1ea1n kh\u1ecfi b\u1ecb l\u00e2y nhi\u1ec5m.<\/p>\n

N\u1ebfu trang web c\u1ee7a b\u1ea1n \u0111\u00e3 b\u1ecb t\u1ea5n c\u00f4ng?<\/strong><\/h2>\n

N\u1ebfu b\u1ea1n \u0111ang s\u1eed d\u1ee5ng WordPress v\u00e0 b\u1ea1n \u0111\u00e3 b\u1ecb t\u1ea5n c\u00f4ng b\u1edfi c\u00e1c hacker. B\u1ea1n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng Wordfence \u0111\u1ec3 x\u00f3a nhi\u1ec1u m\u00e3 \u0111\u1ed9c h\u1ea1i ra kh\u1ecfi trang web c\u1ee7a m\u00ecnh. Wordfence cho ph\u00e9p b\u1ea1n so s\u00e1nh c\u00e1c t\u1ec7p b\u1ecb t\u1ea5n c\u00f4ng v\u1edbi c\u00e1c t\u1ec7p nguy\u00ean m\u1eabu c\u1ee7a WordPress g\u1ed1c trong trang web. V\u00e0 c\u1ea3 c\u00e1c b\u1ea3n sao g\u1ed1c v\u00e0 plugin WordPress. Wordfence cho ph\u00e9p b\u1ea1n xem nh\u1eefng g\u00ec \u0111\u00e3 bi\u1ebfn \u0111\u1ed5i g\u1ea7n \u0111\u00e2y v\u1edbi website c\u1ee7a b\u1ea1n. V\u00e0 cung c\u1ea5p cho b\u1ea1n nh\u1eefng t\u00f9y ch\u1ecdn \u0111\u1ec3 s\u1eeda ch\u1eefa c\u00e1c t\u1eadp tin v\u1edbi c\u00e1c thao t\u00e1c r\u1ea5t \u0111\u01a1n gi\u1ea3n.<\/p>\n

C\u00e1ch kh\u1eafc ph\u1ee5c website Worpress b\u1ecb hack<\/strong><\/h2>\n

Sao l\u01b0u trang web c\u1ee7a b\u1ea1n ngay b\u00e2y gi\u1edd\u00a0<\/strong><\/h3>\n

Khi b\u1ea1n \u0111\u00e3 ch\u1eafc ch\u1eafn r\u1eb1ng b\u1ea1n \u0111\u00e3 b\u1ecb t\u1ea5n c\u00f4ng r\u1ed3i, h\u00e3y sao l\u01b0u trang web c\u1ee7a b\u1ea1n ngay. S\u1eed d\u1ee5ng FTP, h\u1ec7 th\u1ed1ng sao l\u01b0u c\u1ee7a nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 l\u01b0u tr\u1eef ho\u1eb7c plugin sao l\u01b0u \u0111\u1ec3 t\u1ea3i xu\u1ed1ng b\u1ea3n sao to\u00e0n b\u1ed9 trang web ngay.<\/p>\n

L\u00fd do b\u1ea1n c\u1ea7n l\u00e0m l\u00e0 v\u00ec nhi\u1ec1u nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 l\u01b0u tr\u1eef s\u1ebd x\u00f3a ngay to\u00e0n b\u1ed9 trang web. N\u1ebfu b\u1ea1n b\u00e1o c\u00e1o r\u1eb1ng trang web \u0111\u00e3 b\u1ecb t\u1ea5n c\u00f4ng ho\u1eb7c b\u1ecb h\u1ecd ph\u00e1t hi\u1ec7n ra. Nh\u01b0ng \u0111\u00e2y l\u00e0 th\u1ee7 t\u1ee5c ti\u00eau chu\u1ea9n trong m\u1ed9t s\u1ed1 tr\u01b0\u1eddng h\u1ee3p nh\u1eb1m ng\u0103n ch\u1eb7n c\u00e1c h\u1ec7 th\u1ed1ng kh\u00e1c tr\u00ean m\u1ea1ng c\u1ee7a h\u1ecd khi b\u1ecb l\u00e2y nhi\u1ec5m.<\/p>\n

H\u00e3y ch\u1eafc ch\u1eafn r\u1eb1ng b\u1ea1n c\u0169ng sao l\u01b0u t\u1ea5t c\u1ea3 c\u01a1 s\u1edf d\u1eef li\u1ec7u trong trang web c\u1ee7a b\u1ea1n. Sao l\u01b0u c\u00e1c t\u1ec7p v\u00e0 c\u01a1 s\u1edf d\u1eef li\u1ec7u ph\u1ea3i l\u00e0 \u01b0u ti\u00ean h\u00e0ng \u0111\u1ea7u nh\u1ea5t c\u1ee7a b\u1ea1n. Sau \u0111\u00f3 b\u1ea1n c\u00f3 th\u1ec3 chuy\u1ec3n sang b\u01b0\u1edbc ti\u1ebfp theo \u0111\u1ec3 l\u00e0m s\u1ea1ch trang web c\u1ee7a m\u00ecnh m\u1ed9t c\u00e1ch an to\u00e0n nh\u1ea5t c\u00f3 th\u1ec3.<\/p>\n

\"C\u00e1ch<\/p>\n

M\u1ed9t v\u00e0i c\u00f4ng c\u1ee5 h\u1eefu \u00edch cho b\u1ea1n<\/strong><\/h3>\n

N\u1ebfu b\u1ea1n c\u00f3 quy\u1ec1n truy c\u1eadp v\u00e0o SSH m\u00e1y ch\u1ee7 c\u1ee7a m\u00ecnh, h\u00e3y \u0111\u0103ng nh\u1eadp ngay. V\u00e0 ch\u1ea1y l\u1ec7nh sau \u0111\u1ec3 xem t\u1ea5t c\u1ea3 c\u00e1c t\u1ec7p \u0111\u00e3 \u0111\u01b0\u1ee3c s\u1eeda \u0111\u1ed5i trong 2 ho\u1eb7c m\u1ea5y ng\u00e0y qua. L\u01b0u \u00fd r\u1eb1ng d\u1ea5u “.” cho bi\u1ebft th\u01b0 m\u1ee5c hi\u1ec7n t\u1ea1i l\u00e0 g\u00ec. \u0110\u1ec3 t\u00ecm hi\u1ec3u th\u01b0 m\u1ee5c hi\u1ec7n t\u1ea1i c\u1ee7a b\u1ea1n l\u00e0 g\u00ec trong SSH, h\u00e3y nh\u1eadp \u2018pwd\u2019 kh\u00f4ng c\u00f3 d\u1ea5u ngo\u1eb7c k\u00e9p nh\u00e9.<\/p>\n

    \n
  • \n
    t\u00ecm th\u1ea5y. <\/span>-mtime -2 -ls<\/span><\/span><\/pre>\n<\/li>\n<\/ul>\n
    Ho\u1eb7c c\u0169ng c\u00f3 th\u1ec3 ch\u1ec9 \u0111\u1ecbnh m\u1ed9t th\u01b0 m\u1ee5c c\u1ee5 th\u1ec3:<\/p>\n
      \n
    • find \/ home \/ yourdirectory \/ yourite \/ -mtime -2 -ls<\/span><\/span><\/li>\n<\/ul>\n
      Ho\u1eb7c b\u1ea1n c\u00f3 th\u1ec3 thay \u0111\u1ed5i t\u00ecm ki\u1ebfm \u0111\u1ec3 hi\u1ec3n th\u1ecb c\u00e1c t\u1ec7p \u0111\u01b0\u1ee3c s\u1eeda \u0111\u1ed5i trong 10 ng\u00e0y qua:<\/p>\n
        \n
      • find \/ home \/ yourdirectory \/ yourite \/ -mtime -10 -ls<\/span><\/span><\/li>\n<\/ul>\n
        M\u1ed9t c\u00f4ng c\u1ee5 h\u1eefu \u00edch kh\u00e1c trong SSH \u0111\u00f3 l\u00e0 \u2018grep\u2019. V\u00ed d\u1ee5: \u0111\u1ec3 t\u00ecm ki\u1ebfm c\u00e1c t\u1ec7p c\u00f3 ch\u1ee9a base64 (th\u01b0\u1eddng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng b\u1edfi tin t\u1eb7c), b\u1ea1n c\u00f3 th\u1ec3 ch\u1ea1y l\u1ec7nh sau:<\/p>\n
          \n
        • grep -ril base64 *<\/span><\/span><\/li>\n<\/ul>\n
          B\u1ea1n c\u00f3 th\u1ec3 b\u1ecf qua t\u00f9y ch\u1ecdn \u2018l\u2019 \u0111\u1ec3 xem n\u1ed9i dung th\u1ef1c t\u1ebf c\u1ee7a t\u1ec7p n\u01a1i chu\u1ed7i base64 x\u1ea3y ra nh\u1eefng g\u00ec:<\/h6>\n
            \n
          • grep -ri base64 *<\/span><\/span><\/li>\n<\/ul>\n
            H\u00e3y nh\u1edb r\u1eb1ng \u201cbase64\u201d c\u00f3 th\u1ec3 xu\u1ea5t hi\u1ec7n trong nh\u1eefng m\u00e3 h\u1ee3p ph\u00e1p. Tr\u01b0\u1edbc khi x\u00f3a m\u1ecdi th\u1ee9, b\u1ea1n th\u01b0\u1eddng mu\u1ed1n \u0111\u1ea3m b\u1ea3o r\u1eb1ng b\u1ea1n kh\u00f4ng x\u00f3a t\u1ec7p \u0111ang \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng b\u1edfi m\u1ed9t ch\u1ee7 \u0111\u1ec1. Ho\u1eb7c plugin tr\u00ean trang web c\u1ee7a m\u00ecnh. M\u1ed9t t\u00ecm ki\u1ebfm tinh t\u1ebf h\u01a1n c\u00f3 th\u1ec3 th\u1ea5y nh\u01b0 th\u1ebf n\u00e0y:<\/p>\n
              \n
            • grep –include = *. <\/span>php -rn. <\/span>-e “base64_decode”<\/span><\/span><\/li>\n<\/ul>\n
              \"C\u00e1ch<\/p>\n
              L\u1ec7nh n\u00e0y t\u00ecm ki\u1ebfm t\u1ea5t c\u1ea3 c\u00e1c t\u1ec7p .php cho chu\u1ed7i \u201cbase64_decode\u201d v\u00e0 in s\u1ed1 d\u00f2ng \u0111\u1ec3 b\u1ea1n c\u00f3 th\u1ec3 d\u1ec5 d\u00e0ng t\u00ecm th\u1ea5y m\u00e0 khi chu\u1ed7i xu\u1ea5t hi\u1ec7n.<\/p>\n
              Nh\u1eefng g\u00ec b\u1ea1n c\u1ea7n l\u00e0m l\u00e0 t\u00ecm c\u00e1c t\u1ec7p \u0111\u00e3 \u0111\u01b0\u1ee3c s\u1eeda \u0111\u1ed5i g\u1ea7n \u0111\u00e2y, xem nh\u1eefng g\u00ec \u0111\u00e3 \u0111\u01b0\u1ee3c s\u1eeda \u0111\u1ed5i trong t\u1ec7p v\u00e0 n\u1ebfu b\u1ea1n t\u00ecm th\u1ea5y m\u1ed9t chu\u1ed7i v\u0103n b\u1ea3n ph\u1ed5 bi\u1ebfn nh\u01b0 \u201cbad hacker was here\u201d th\u00ec b\u1ea1n c\u00f3 th\u1ec3 grep t\u1ea5t c\u1ea3 c\u00e1c t\u1ec7p c\u1ee7a m\u00ecnh cho v\u0103n b\u1ea3n \u0111\u00f3 nh\u01b0 sau:<\/p>\n
                \n
              • grep -irl “bad hacker \u0111\u00e3 \u1edf \u0111\u00e2y” *<\/span><\/span><\/li>\n<\/ul>\n
                v\u00e0 \u0111i\u1ec1u \u0111\u00f3 s\u1ebd cho b\u1ea1n th\u1ea5y t\u1ea5t c\u1ea3 c\u00e1c t\u1ec7p b\u1ecb nhi\u1ec5m ch\u1ee9a v\u0103n b\u1ea3n “bad hacker was here”.<\/p>\n
                  \n
                • find public_html \/ wp-content \/ uploads \/ -type f -not -name “* .jpg” -not -name “* .png” -not -name “* .gif” -not -name “* .jpeg”> uploads -non-binary.log<\/span><\/span><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
                  C\u00e1ch kh\u1eafc ph\u1ee5c website Worpress b\u1ecb hack. B\u00e0i vi\u1ebft n\u00e0y cung c\u1ea5p m\u1ed9t s\u1ed1 c\u00f4ng c\u1ee5 m\u00e0 b\u1ea1n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng \u0111\u1ec3 gi\u00fap l\u00e0m s\u1ea1ch trang web c\u1ee7a b\u1ea1n kh\u1ecfi b\u1ecb l\u00e2y nhi\u1ec5m. N\u1ebfu trang web c\u1ee7a b\u1ea1n \u0111\u00e3 b\u1ecb t\u1ea5n c\u00f4ng? N\u1ebfu b\u1ea1n \u0111ang s\u1eed d\u1ee5ng WordPress v\u00e0 b\u1ea1n \u0111\u00e3 b\u1ecb t\u1ea5n c\u00f4ng […]<\/p>\n","protected":false},"author":3,"featured_media":3158,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[8],"tags":[],"class_list":["post-3156","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-thiet-ke-website"],"jetpack_featured_media_url":"https:\/\/webvocuc.com\/blog\/wp-content\/uploads\/2021\/04\/Cach-khac-phuc-website-Worpress-bi-hack-1.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/posts\/3156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/comments?post=3156"}],"version-history":[{"count":0,"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/posts\/3156\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/media\/3158"}],"wp:attachment":[{"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/media?parent=3156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/categories?post=3156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webvocuc.com\/blog\/wp-json\/wp\/v2\/tags?post=3156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}