当前位置： 首页 > news >正文

rdpwsx!TSrvInitWD函数分析到rdpwd!WDWConfConnect

news 2025/11/2 9:19:50

rdpwsx!TSrvInitWD函数分析到rdpwd!WDWConfConnect


21:19:13.843 892767D4.E11B61D0 TShrSRV: TSrvInitWD entry
21:19:13.843 892CDCFC.E13610C8 GCC: mcsCallback exit - 0x0
21:19:13.843 892767D4.E11B61D0 TShrSRV: Performing WDTShare connection info exchange
21:19:13.843 892767D4.E11B61D0 TShrSRV: TSrvInitWDConnectInfo entry
21:19:13.843 892767D4.E11B61D0 TShrSRV: Allocated 0x80 bytes to recieve WDTShare return data
21:19:13.843 892767D4.E11B61D0 TShrSRV: Performing connect (size=128)
21:19:13.843 892CDCFC.E13610C8 TermDD: IcaReferenceChannel: cc 5, vc 31, ref 1
21:19:13.859 892767D4.E11B61D0 TermDD: IcaDeviceControlStack, fc 2304 (enter)
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WD_Ioctl     0489 IOCTL_TSHARE_CONF_CONNECT (2304)
21:19:13.859 892CDCFC.E13610C8 TermDD: IcaDefeferenceChannel: cc 5, vc 31, ref 2
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WD_Ioctl     0816 Got TSHARE_CONF_CONNECT IOCtl
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WDWParseUser 1484 GCC_H221_NONSTANDARD_KEY
44 75 63 61                                       Duca
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WDWParseUser 1615 Our client's User Data
01 C0 D4 00 04 00 08 00 40 06 38 04 01 CA 03 AA   ........@.8.....
04 08 00 00 CE 0E 00 00 4F 00 53 00 2D 00 32 00   ........O.S.-.2.
30 00 32 00 35 00 30 00 37 00 30 00 31 00 58 00   0.2.5.0.7.0.1.X.
45 00 42 00 4C 00 00 00 04 00 00 00 00 00 00 00   E.B.L...........
0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 01 CA 01 00 00 00 00 00 18 00 07 00   ................
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 04 C0 0C 00 0D 00 00 00 00 00 00 00   ................
02 C0 0C 00 1B 00 00 00 00 00 00 00 03 C0 2C 00   ..............,.
03 00 00 00 72 64 70 64 72 00 00 00 00 00 80 80   ....rdpdr.......
63 6C 69 70 72 64 72 00 00 00 A0 C0 72 64 70 73   cliprdr.....rdps
6E 64 00 00 00 00 00 C0                           nd......
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WDWParseUser 1631 Core data
01 C0 D4 00 04 00 08 00 40 06 38 04 01 CA 03 AA   ........@.8.....
04 08 00 00 CE 0E 00 00 4F 00 53 00 2D 00 32 00   ........O.S.-.2.
30 00 32 00 35 00 30 00 37 00 30 00 31 00 58 00   0.2.5.0.7.0.1.X.
45 00 42 00 4C 00 00 00 04 00 00 00 00 00 00 00   E.B.L...........
0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 01 CA 01 00 00 00 00 00 18 00 07 00   ................
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
00 00 00 00                                       ....
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WDWParseUser 1674 Cluster data
04 C0 0C 00 0D 00 00 00 00 00 00 00               ............
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WDWParseUser 1650 Security data
02 C0 0C 00 1B 00 00 00 00 00 00 00               ............
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WDWParseUser 1662 Net data
03 C0 2C 00 03 00 00 00 72 64 70 64 72 00 00 00   ..,.....rdpdr...
00 00 80 80 63 6C 69 70 72 64 72 00 00 00 A0 C0   ....cliprdr.....
72 64 70 73 6E 64 00 00 00 00 00 C0               rdpsnd......
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WDWConnect   0305 Client version is 0x80004
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WDWConnect   0328 ErrorInfoPDU supported = 1
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WDWConnect   0346 Client requests color depth 24, server limit 16
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 WDWConnect   0350 Limiting requested color depth...
21:19:13.875 892767D4.E11B61D0 RDP+E10C2010+WDWConnect  +0374+Restricted requested color depth 24 to 16
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 WDWConnect   0431 16 BPP (565)
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 WDWConnect   0502 Client supports load balance redirection
RDPWD: New: ShareClass at E88E0A90, size=1392
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 WDWNewShareC 2528 Created Share Class
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 SM_Init      0234 encryption level is 2
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 SM_Init      0265 Encrypting
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 SM_Init      0308 Encryption methods supported 0000001b: Level 2

21:19:13.875 892767D4.E11B61D0 RDP E10C2010 SM_Init      0365 Set state from SM_STATE_STARTED to SM_STATE_INITIALIZED
21:19:13.875 892767D4.E11B61D0 RDP+E10C2010+SM_Connect  +0500+Client supports encryption: 1b
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 SM_Connect   0502 Server supports encryption: 1b
21:19:13.875 892767D4.E11B61D0 RDP+E10C2010+SM_Connect  +0639+Encryption Method=2, Level=2, Display=1
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 SM_Connect   0650 Init Fips succeed

21:19:13.875 892767D4.E11B61D0 RDP E10C2010 SM_Connect   0689 Set state from SM_STATE_INITIALIZED to SM_STATE_NM_CONNECTING
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 SM_Connect   0691 Connect to Network Manager
21:19:13.875 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0181 Net User Data
03 C0 2C 00 03 00 00 00 72 64 70 64 72 00 00 00   ..,.....rdpdr...
00 00 80 80 63 6C 69 70 72 64 72 00 00 00 A0 C0   ....cliprdr.....
72 64 70 73 6E 64 00 00 00 00 00 C0               rdpsnd......
21:19:13.890 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0185 Protocol version 0x80004 (0x8/0x4)
21:19:13.890 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0247 Channel 0 (was 0): rdpdr
21:19:13.890 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0247 Channel 1 (was 1): cliprdr
21:19:13.890 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0247 Channel 2 (was 2): rdpsnd
21:19:13.890 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0289 Attach User
21:19:13.890 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0303 AttachUser OK, hUser E88724C8
21:19:13.890 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0312 Attached as user 3ea, hUser E88724C8
21:19:13.890 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0336 Joined broadcast channel 3eb (hChannel E167E190) OK
21:19:13.906 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0356 Joined user channel (hChannel E8872614) OK
21:19:13.906 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0394 Joined VC 0: 1004 (hChannel E1189EA0)
21:19:13.906 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0394 Joined VC 1: 1005 (hChannel E167E148)
21:19:13.906 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0394 Joined VC 2: 1006 (hChannel E118F638)
21:19:13.906 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0419 Copy 3 channels to user data out
21:19:13.906 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0428 Channel 0 (0) = 0x3ec
21:19:13.921 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0428 Channel 1 (1) = 0x3ed
21:19:13.921 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0428 Channel 2 (2) = 0x3ee
21:19:13.921 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0434 Tell SM we're connecting
21:19:13.921 892767D4.E11B61D0 RDP E10C2010 SM_OnConnect 0117 Connected OK as user 3ea
21:19:13.921 892767D4.E11B61D0 RDP E10C2010 SM_OnConnect 0132 Set state from SM_STATE_NM_CONNECTING to SM_STATE_SM_CONNECTING
21:19:13.921 892767D4.E11B61D0 RDP E10C2010 WDW_OnSMConn 0677 pOutData at 00D76148
21:19:13.937 892767D4.E11B61D0 RDP E10C2010 WDW_OnSMConn 0711 Key octet at 00D76168 (offs 00000020)
21:19:13.937 892767D4.E11B61D0 RDP E10C2010 WDW_OnSMConn 0719 Data octet pointer at 00D7616C (offs 00000024)
21:19:13.937 892767D4.E11B61D0 RDP E10C2010 WDW_OnSMConn 0733 Core data at 00D76174 (offs 0000002C)
21:19:13.937 892767D4.E11B61D0 RDP E10C2010 WDW_OnSMConn 0738 Net data at 00D7617C (offs 00000034)
21:19:13.937 892767D4.E11B61D0 RDP E10C2010 WDW_OnSMConn 0747 Sec data at 00D7618C (offs 00000044)
21:19:13.937 892767D4.E11B61D0 RDP E10C2010 WDW_OnSMConn 0757 Build 80 bytes of returned user data
21:19:13.937 892767D4.E11B61D0 RDP E10C2010 WDW_OnSMConn 0758 Returned user data
50 00 00 00 04 00 08 00 98 5C D7 00 01 00 00 00   P........\......
02 00 00 00 04 00 00 00 20 00 00 00 24 00 00 00   ........ ...$...
4D 63 44 6E 24 00 00 10 2C 00 00 00 01 0C 08 00   McDn$...,.......
04 00 08 00 03 0C 10 00 EB 03 03 00 EC 03 ED 03   ................
EE 03 00 00 02 0C 0C 00 02 00 00 00 02 00 00 00   ................
21:19:13.937 892767D4.E11B61D0 RDP E10C2010 SM_OnConnect 0142 Free user data
21:19:13.937 892767D4.E11B61D0 RDP E10C2010 NM_Connect   0451 Free user data
21:19:13.937 892767D4.E11B61D0 TermDD: IcaDeviceControlStack, fc 2304, 0x0
21:19:13.937 892767D4.E11B61D0 TShrSRV: TSrvInitWDConnectInfo exit - 0x0
21:19:13.937 892767D4.E11B61D0 TShrSRV: TSrvInitWD exit - 0x0

21:19:13.843 892767D4.E11B61D0 TShrSRV: TSrvInitWD entry
21:19:13.843 892767D4.E11B61D0 TShrSRV: Performing WDTShare connection info exchange

NTSTATUS
TSrvInitWD(IN PTSRVINFO pTSrvInfo, IN OUT PUSERDATAINFO *ppUserDataInfo)
{
NTSTATUS    ntStatus;
PVOID       pSecData;

    TRACE((DEBUG_TSHRSRV_FLOW,
"TShrSRV: TSrvInitWD entry\n"));

    // Pass on connection information

    TRACE((DEBUG_TSHRSRV_NORMAL,
"TShrSRV: Performing WDTShare connection info exchange\n"));

    ntStatus = TSrvInitWDConnectInfo(pTSrvInfo->hStack,
pTSrvInfo,
ppUserDataInfo,
IOCTL_TSHARE_CONF_CONNECT,
NULL, 0, TRUE, &pSecData);

    if (!NT_SUCCESS(ntStatus))
{
TRACE((DEBUG_TSHRSRV_DEBUG,
"TShrSRV: WDTShare connection info exchange unsuccessful - 0x%x\n", ntStatus));
}

    TRACE((DEBUG_TSHRSRV_FLOW,
"TShrSRV: TSrvInitWD exit - 0x%x\n", ntStatus));

    return (ntStatus);
}


#define IOCTL_TSHARE_CONF_CONNECT       _ICA_CTL_CODE(0x900, METHOD_NEITHER)
1: kd> ?0x900
Evaluate expression: 2304 = 00000900

21:19:13.843 892767D4.E11B61D0 TShrSRV: TSrvInitWDConnectInfo entry
21:19:13.843 892767D4.E11B61D0 TShrSRV: Allocated 0x80 bytes to recieve WDTShare return data
21:19:13.843 892767D4.E11B61D0 TShrSRV: Performing connect (size=128)


NTSTATUS
TSrvInitWDConnectInfo(IN HANDLE hStack,
IN PTSRVINFO pTSrvInfo,
IN OUT PUSERDATAINFO *ppUserDataInfo,
IN ULONG ioctl,
IN PBYTE pModuleData,
IN ULONG cbModuleData,
IN BOOLEAN bGetCert,
OUT PVOID *ppSecInfo)
{
int                 i;
ULONG               ulInBufferSize;
ULONG               ulBytesReturned;
PUSERDATAINFO       pUserDataInfo;
PUSERDATAINFO       pUserDataInfo2;
NTSTATUS            ntStatus;

    TRACE((DEBUG_TSHRSRV_FLOW,
"TShrSRV: TSrvInitWDConnectInfo entry\n"));

    // For a standard connection we receive client user data as part of the
// GCC connection request.  Shadow connections are initiated via RPC and
// the input buffer contains the format sent by the other TS.
if (ioctl == IOCTL_TSHARE_CONF_CONNECT) {
TS_ASSERT(pTSrvInfo->pUserDataInfo);
TS_ASSERT(pTSrvInfo->pUserDataInfo->cbSize);
}

    // Allocate a block of memory to receive return UserData from
// WDTShare.  This data will subsequently be sent to the client
// via TSrvConfCreateResp.
pUserDataInfo = TSHeapAlloc(0, 128, TS_HTAG_TSS_USERDATA_OUT);
if (pUserDataInfo != NULL) {
// Set the UserData cbSize element.  This is so that WDTShare can
// determine if there is sufficient space available to place the
// return data into
pUserDataInfo->cbSize = 128 ;

        TRACE((DEBUG_TSHRSRV_DETAIL,
"TShrSRV: Allocated 0x%x bytes to recieve WDTShare return data\n",
pUserDataInfo->cbSize));

        // Exchange UserData with WDTShare.  If the provided output buffer
// (pUserDataInfo) is large enough then the data will be exchanged
// in one call.  If the buffer is not large enough, then it is up to
// WDTShare to tell TShareSRV how to react.  For general errors we
// just exit.  For STATUS_BUFFER_TOO_SMALL errors, TShareSrv looks at
// the returned cbSize to determine how to adjust the buffer.   If
// WDTShare did not increase the cbSize then TShareSrv will increase
// it by a default amount (128 bytes).  TShareSrv will use the new value
// to reallocate the output buffer and try the WDTShare call again.
// (Note that TShareSrv will only try this a max of 20 times)
for (i = 0; i < 20; i++) {
            TRACE((DEBUG_TSHRSRV_NORMAL, "TShrSRV: Performing connect (size=%ld)\n",
pUserDataInfo->cbSize));

            ulBytesReturned = 0;

            // Pass the actual client user data to the WD
            if (ioctl == IOCTL_TSHARE_CONF_CONNECT) {
ntStatus = IcaStackIoControl(hStack,
ioctl,
pTSrvInfo->pUserDataInfo,
pTSrvInfo->pUserDataInfo->cbSize,
pUserDataInfo,
pUserDataInfo->cbSize,
&ulBytesReturned);
}

            // Pass the shadow module data to the WD
else {
ntStatus = IcaStackIoControl(hStack,
ioctl,
pModuleData,
cbModuleData,
pUserDataInfo,
pUserDataInfo->cbSize,
&ulBytesReturned);

#define IOCTL_TSHARE_CONF_CONNECT       _ICA_CTL_CODE(0x900, METHOD_NEITHER)
1: kd> ?0x900
Evaluate expression: 2304 = 00000900


21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WD_Ioctl     0489 IOCTL_TSHARE_CONF_CONNECT (2304)
21:19:13.859 892767D4.E11B61D0 RDP E10C2010 WD_Ioctl     0816 Got TSHARE_CONF_CONNECT IOCtl


NTSTATUS WD_Ioctl(PTSHARE_WD pTSWd, PSD_IOCTL pSdIoctl)
{
NTSTATUS status = STATUS_SUCCESS;
UINT32   bufferLen;
unsigned fn;
PVIDEO_MODE_INFORMATION pVidInfo;

    DC_BEGIN_FN("WD_Ioctl");

    else {
// Non-perf path IOCTLs.
fn = WDW_IOCTL_FUNCTION(pSdIoctl->IoControlCode);
TRC_NRM((TB, "%s (%d)",

                fn == 0x900 ? "IOCTL_TSHARE_CONF_CONNECT" :


fn));
}


case IOCTL_TSHARE_CONF_CONNECT:
{
            TRC_NRM((TB, "Got TSHARE_CONF_CONNECT IOCtl"));
status = WDWConfConnect(pTSWd, pSdIoctl);
}
break;

NTSTATUS WDWConfConnect(PTSHARE_WD pTSWd, PSD_IOCTL pSdIoctl)
{
NTSTATUS status = STATUS_SUCCESS;
unsigned DataLen;
PRNS_UD_CS_CORE pClientCoreData;
PRNS_UD_CS_SEC  pClientSecurityData;
PRNS_UD_CS_NET  pClientNetData;
PTS_UD_CS_CLUSTER pClientClusterData;

    DC_BEGIN_FN("WDWConfConnect");

    // First make sure we've received enough data for the initial headers
// and that the sizes presented in the data block are valid. An attacker
// might try sending malformed data here to fault the server.
DataLen = pSdIoctl->InputBufferLength;
if (sizeof(USERDATAINFO)>DataLen) {
TRC_ERR((TB,"Apparent attack via user data, size %u too small for UD hdr",
DataLen));
WDW_LogAndDisconnect(pTSWd, TRUE, Log_RDP_BadUserData, pSdIoctl->InputBuffer,
DataLen);
status = STATUS_UNSUCCESSFUL;
DC_QUIT;
}

    if (((PUSERDATAINFO)pSdIoctl->InputBuffer)->cbSize > DataLen) {
TRC_ERR((TB,"Apparent attack via user data, the cbSize is set to a length bigger then the total buffer %u",
((PUSERDATAINFO)pSdIoctl->InputBuffer)->cbSize > DataLen));
WDW_LogAndDisconnect(pTSWd, TRUE, Log_RDP_BadUserData, pSdIoctl->InputBuffer,
DataLen);
status = STATUS_UNSUCCESSFUL;
DC_QUIT;
}

// Validate that the output buffer is big enough.
if ((pSdIoctl->OutputBuffer == NULL) ||
(pSdIoctl->OutputBufferLength < MIN_USERDATAINFO_SIZE)) {
TRC_ERR((TB, "No Out Buffer on TSHARE_CONF_CONNECT."));
status = STATUS_BUFFER_TOO_SMALL;
DC_QUIT;
}

    if (((PUSERDATAINFO)pSdIoctl->OutputBuffer)->cbSize < MIN_USERDATAINFO_SIZE) {
// Buffer has been supplied but is too small, - so tell
// TShareSRV how big a buffer we actually need.

((PUSERDATAINFO)pSdIoctl->OutputBuffer)->cbSize = MIN_USERDATAINFO_SIZE;

            TRC_ERR((TB, "Telling TShareSRV to have another go with %d",
MIN_USERDATAINFO_SIZE));

status = STATUS_BUFFER_TOO_SMALL;
DC_QUIT;
}

    // Parse the input data.
if (WDWParseUserData(pTSWd, (PUSERDATAINFO)pSdIoctl->InputBuffer, DataLen,
NULL, 0, &pClientCoreData, &pClientSecurityData,
&pClientNetData, &pClientClusterData)) {
status = WDWConnect(pTSWd, pClientCoreData, pClientSecurityData,
pClientNetData, pClientClusterData, pSdIoctl, FALSE);
}
else {
status = STATUS_UNSUCCESSFUL;
TRC_ERR((TB, "Could not parse the user data successfully"));
}

DC_EXIT_POINT:
DC_END_FN();
return status;
} /* WDWConfConnect */

 

http://www.dtcms.com/a/557657.html

相关文章：

  • 购买一级域名做网站青岛seo关键词排名
  • 如何建网站保定自己做公司网站简单吗
  • 怎样理解网站建设与开发这门课红杉树装饰公司口碑怎么样
  • 用 Trae AI 编程打造我的个人成长空间：旅行、相册、我的信息模块全上线！
  • 临海 网站建设友情链接是什么意思
  • 意大利语网站建设软件工程学科评估
  • AutoCAD 2025软件安装包下载及安装教程
  • arcpy_pytho2.7_arcmap10.2乱码问题
  • MATLAB水滴下落湖水面泛起涟漪仿真
  • 【Python】For Midterm Review2（week1-6）
  • 智驾“请抬脚”提示感悟 - 当工程师思维遇见用户思维
  • AFFiNE：打破界限的知识平台，超越Notion与Miro！
  • 集团网站下分网站 模板wordpress企业网站 教程
  • 我在CSDN学MYSQL之----数据库基本概念和基本知识（下）
  • 神经符号系统架构：结合深度学习与符号推理的混合智能
  • wordpress 怎么学镇江网站关键字优化机构
  • JSP 点击量统计：技术与实践
  • QML学习笔记（五十）QML与C++交互：QML中单例C++对象
  • （108页PPT）金属加工行业智能工厂系统解决方案（附下载方式）
  • 网站建设情况说明搭建网站要什么显卡
  • C++11新特性基础知识点汇总
  • 网站icp查询系统山东seo网络营销推广
  • Vue.js 3的组合式API
  • 竞品对比分析：我们的系统 vs Reddit Answer
  • SQLite AND/OR 运算符
  • 物理仿真学习笔记 第一篇：绳子（弹簧振子系统，阻尼）
  • 柳州游戏网站建设seo综合查询网站
  • 网站推广的短视频推广wordpress 文章导入
  • SQL学习之常见函数和连接查询
  • html制作企业宣传网站wordpress企业网站开发