📁
ＳＫＹＳＨＥＬＬ ＭＡＮＡＧＥＲ
PHP v7.4.34
Create
Create
Path:
root
/
home
/
estate38
/
PPE.dlfoffice.com
/
Name
Size
Perm
Actions
📁
wp-includes
-
0755
🗑️
🏷️
🔒
📁
wp-admin
-
0755
🗑️
🏷️
🔒
📁
well-known
-
0755
🗑️
🏷️
🔒
📁
store
-
0755
🗑️
🏷️
🔒
📁
wp-content
-
0755
🗑️
🏷️
🔒
📁
configWVM
-
0755
🗑️
🏷️
🔒
📁
images
-
0755
🗑️
🏷️
🔒
📁
cgi-bin
-
0755
🗑️
🏷️
🔒
📁
404LSO
-
0755
🗑️
🏷️
🔒
📁
.well-known
-
0755
🗑️
🏷️
🔒
📄
wp-signup.php
34.69 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-settings.php
32.81 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-config.php
3.52 KB
0600
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-load.php
3.98 KB
0444
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-links-opml.php
2.87 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-cron.php
8.23 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-trackback.php
5.71 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-mail.php
8.96 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-activate.php
7.97 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-config-sample.php
3.7 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-comments-post.php
2.7 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-blog-header.php
0.49 KB
0444
🗑️
🏷️
⬇️
✏️
🔒
📄
wp-active.php
261.01 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
robots.txt
0.08 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
readme.html
7.47 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
post-new.php
0.13 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
php.ini
0.1 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
license.txt
19.44 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
index.php
20.27 KB
0444
🗑️
🏷️
⬇️
✏️
🔒
📄
.htaccess
0.08 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
📄
xjctwsbd.php
18.64 KB
0644
🗑️
🏷️
⬇️
✏️
🔒
Edit: 20_known_hacks.conf
# Mitigation for a timthumb exploit described at http://seclists.org/fulldisclosure/2014/Jun/117 # Trac 7313 SecRule ARGS:src "(:?\$\(|`).*(:?\)|`)" \ "chain,deny,log,auditlog,status:406,\ msg:'ARGS:src contains shell special characters',id:'13055',\ tag:'WEB_ATTACK/SHELL ACCESS',severity:'4',\ t:none,t:htmlEntityDecode,t:urlDecode" SecRule &ARGS:webshot "@gt 0" # Stop requests to known hack scripts SecRule REQUEST_URI "/plugins/system/infophp.php" \ "log,deny,status:406,auditlog,id:13923,rev:1,severity:3,\ msg:'Access to known hack script',\ tag:'WEB_ATTACK/SHELL ACCESS'" # Stop requests to a known DoS script SecRule ARGS:action "(udp|tcp|syn|http)" "t:lowercase,log,deny,auditlog,\ id:13924,deny,status:406,severity:3,msg:'Access to known hack script',\ tag:'WEB_ATTACK/SHELL ACCESS',chain" SecRule ARGS_NAMES "host" "t:lowercase,chain" SecRule REQUEST_URI "online\.php" "t:lowercase" # Stop requests to known shells SecRule REQUEST_URI "/w[0-9][0-9]+w*\.php" \ "log,deny,status:406,auditlog,id:13929,rev:1,severity:3,\ msg:'known php shell',\ tag:'WEB_ATTACK/SHELL ACCESS'" SecRule REQUEST_URI "/sm[0-9]+rk[0-9]+\.php" \ "log,deny,status:406,auditlog,id:13930,rev:1,severity:3,\ msg:'known php shell',\ tag:'WEB_ATTACK/SHELL ACCESS'" # Blocks request to hacks in the bluestork admin template folder, a common Joomla hack payload SecRule REQUEST_URI "administrator/templates/bluestork/((indx|stph|stcp|start|startphp)\.php|(run|f1)\.pl)" \ "deny,log,auditlog,status:406,id:'13999',\ t:none,t:lowercase,t:htmlEntityDecode,t:removeWhitespace,\ msg:'Joomla Admin bluestork theme exploits',\ tag:'WEB_ATTACK/SHELL EXPLOIT',severity:'4'" # Stop requests to l_backuptoster.php SecRule REQUEST_URI "/l_backuptoster.*\.php" \ "log,deny,status:406,auditlog,id:13582,rev:1,severity:3,\ msg:'l_backuptoster.php spam script',\ tag:'WEB_ATTACK/SPAMBOT'" # No posts to dvmessages\.php SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,\ msg:'POST to dvmessages.php',id:'13068',\ tag:'WEB_ATTACK/SHELL ACCESS',severity:'4'" SecRule REQUEST_URI "dvmessages\.php" # No posts to known hack/mailer URIs SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,id:'13069',severity:'4',\ msg:'POST request to hack/mailer script',\ tag:'WEB_ATTACK/SHELL ACCESS'" SecRule REQUEST_URI "/(?:(?:components/com_content/(?:statistics[0-9A-Za-z_-]{4}|com_it|faccount)).*\.php)|(?:wp-content/mod_gogle/)" # Block known behavior for interacting with a PHP shell SecRule REQUEST_URI "/stph\.php\?.*(page|action\=(start|status))"\ "deny,log,auditlog,status:406,id:'13998',severity:'4',\ t:none,t:lowercase,t:htmlEntityDecode,t:removeWhitespace,\ msg:'stph.php shell',\ tag:'WEB_ATTACK/SHELL EXPLOIT'" # Block POSTs to mod_frosty hacks SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,id:'13996',severity:'4',\ msg:'POST request to known hack',\ tag:'WEB_ATTACK/SHELL ACCESS'" SecRule REQUEST_URI "/mod_frosty/.*\.php" "t:lowercase,t:removeWhitespace" # Block POSTs to xcloner shells. PHP scripts matching [a-z0-9]{6}\.php do not exist in the plugin SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,\ msg:'POST request to known hack',id:'13997',tag:'WEB_ATTACK/SHELL ACCESS',\ severity:'4'" SecRule REQUEST_URI "/(?:com_)?xcloner-backup-?and-?restore.*/[a-z0-9]{6}\.php$" # Block xmlrpc calls with specific User-Agent SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,\ msg:'POST request to xmlrpc from bad User-Agent',id:'13995',tag:'WEB_ATTACK/XMLRPC',\ severity:'4'" SecRule REQUEST_URI "xmlrpc\.php" "chain" SecRule HTTP_User-Agent "Mozilla\/4\.0 \(compatible; Win32; WinHttp\.WinHttpRequest\.5\)" # Block requests to php hidden files SecRule REQUEST_URI "\/\.[a-zA-Z0-9].+\.php" \ "log,deny,status:406,auditlog,id:14203,rev:1,severity:3,\ msg:'Blocking access to hidden php files'" # Block requests to potential cryptolocker hacks SecRule REQUEST_METHOD "POST" \ "chain,log,deny,status:406,auditlog,id:14208,rev:1,severity:3,\ msg:'Blocking acccess to potential cryptolocker activation'" SecRule REQUEST_URI "\/skin\/error\.php" # Block access to known botnet scripts SecRule REQUEST_METHOD "POST" \ "chain,log,deny,status:406,auditlog,id:14209,rev:1,severity:3,\ msg:'Blocking acccess to known botnet scripts'" SecRule REQUEST_URI "\/plugins\/index\.php\?cookie=1" "chain" SecRule HTTP_USER-Agent "Mozilla\/5\.0 \(compatible\; Googlebot\/2\.1\; \+http://www.google\.com\/bot\.html\)" # Block access to known Fox* botnet scripts SecRule REQUEST_URI "\/[a-z]{8}\.php\?Fox\=" \ "log,deny,status:406,auditlog,id:14210,rev:1,severity:3,\ msg:'Block access to known Fox botnet scripts'"
Save