The problem! You guys jacked up the .htaccess file with all this bullshit! Site popped right back online once this garbage was removed!
# Created by 6Scan plugin
#Those are used by 6Scan Gateway
SetEnv SIXSCAN_HTACCESS_VERSION 1
SetEnv SIXSCAN_WP_BASEDIR /
#don’t show directory listing and apache information
ServerSignature Off
<IfModule mod_rewrite.c>
RewriteEngine On
#avoid direct access to the 6scan-gate.php file
RewriteCond %{ENV:REDIRECT_sixscaninternal} !^accessgranted$
RewriteCond %{ENV:sixscaninternal} !^accessgranted$
RewriteCond %{REQUEST_URI} 6scan-gate\.php$
RewriteRule ^(.*)$ – [F]
#This is not really a must, but speeds things up a bit
RewriteRule ^6scan-gate\.php$ – [L]
#Patrol’s IPs needs access, to check whether rules update is required
RewriteCond %{REMOTE_ADDR} ^108\.59\.1\.37$ [OR]
RewriteCond %{REMOTE_ADDR} ^108\.59\.5\.197$ [OR]
RewriteCond %{REMOTE_ADDR} ^108\.59\.2\.209$ [OR]
RewriteCond %{REMOTE_ADDR} ^95\.211\.58\.114$ [OR]
RewriteCond %{REMOTE_ADDR} ^95\.211\.70\.82$ [OR]
RewriteCond %{REMOTE_ADDR} ^107\.22\.183\.61$ [OR]
RewriteCond %{REMOTE_ADDR} ^78\.47\.11\.131$ [OR]
RewriteCond %{REMOTE_ADDR} ^199\.115\.112\.90$ [OR]
RewriteCond %{REMOTE_ADDR} ^192\.96\.201\.13$
RewriteRule ^(.*)$ – [S=6]
#Broad-spectrum protection: User agent/referrer injections. XSS,RFI and SQLI prevention
RewriteCond %{REQUEST_METHOD} ^(OPTIONS|PUT|DELETE|TRACE|CONNECT|PATCH|TRACK|DEBUG) [NC]
RewriteRule .* – [E=sixscansecuritylog:1,E=sixscanstrangerequest:1] –
RewriteCond %{QUERY_STRING} (http(s)?(:|%3A)(/|%2F)(/|%2F)|ftp(:|%3A)(/|%2F)(/|%2F)|zlib(:|%3A)|bzip2(:|%3A)) [NC]
RewriteRule .* – [E=sixscansecuritylog:1,E=sixscanwafrfi:1] –
RewriteCond %{REQUEST_METHOD} ^(POST) [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^(WordPress\/[\d.]+;\s+)?https?://(www.)?domain\.com [NC]
RewriteRule .* – [E=sixscansecuritylog:1,E=sixscanwafcsrf:1] –
RewriteCond %{QUERY_STRING} (<|%3c).*(script|iframe|src).*(>|%3e) [NC]
RewriteRule .* – [E=sixscansecuritylog:1,E=sixscanwafxss:1] –
RewriteCond %{QUERY_STRING} union.*select [NC,OR]
RewriteCond %{QUERY_STRING} (concat|delete|right|ascii|left|mid|version|substring|extractvalue|benchmark|load_file).*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} (into.*outfile) [NC,OR]
RewriteCond %{QUERY_STRING} (having.*–) [NC]
RewriteRule .* – [E=sixscansecuritylog:1,E=sixscanwafsqli:1] –
RewriteCond %{REQUEST_URI} ^/just/a/random/dir/to/avoid/htaccess/mixups\.php
RewriteRule .* /6scan-gate.php [E=sixscaninternal:accessgranted,L]
</IfModule>
# End of 6Scan plugin
Also manually removed 6scan-gate.php and 6scan-signature.php from my root folder! What a crock of crap.
Has your code been injected anywhere else that isn’t visible?
