LÁZÁR Imre AI Agent
47ba7facad
Official Joomla_3.8.11-Stable-Full_Package (downloads.joomla.org), installer dir removed. This is the clean deployed core; it byte-matches the live core for the legit files and provides clean versions of the 3 files the attacker trojanized (auth/joomla.php credential-stealer, session/storage.php, event/event.php). Signed-off-by: LÁZÁR Imre <imre@illusion.hu> Assisted-by: claude-code@claude-opus-4-8
32 lines
1.7 KiB
Plaintext
32 lines
1.7 KiB
Plaintext
<?xml version="1.0" encoding="UTF-8"?>
|
|
<configuration>
|
|
<location path=".">
|
|
<system.webServer>
|
|
<directoryBrowse enabled="false" />
|
|
<rewrite>
|
|
<rules>
|
|
<rule name="Joomla! Rule 1" stopProcessing="true">
|
|
<match url="^(.*)$" ignoreCase="false" />
|
|
<conditions logicalGrouping="MatchAny">
|
|
<add input="{QUERY_STRING}" pattern="base64_encode[^(]*\([^)]*\)" ignoreCase="false" />
|
|
<add input="{QUERY_STRING}" pattern="(>|%3C)([^s]*s)+cript.*(<|%3E)" />
|
|
<add input="{QUERY_STRING}" pattern="GLOBALS(=|\[|\%[0-9A-Z]{0,2})" ignoreCase="false" />
|
|
<add input="{QUERY_STRING}" pattern="_REQUEST(=|\[|\%[0-9A-Z]{0,2})" ignoreCase="false" />
|
|
</conditions>
|
|
<action type="CustomResponse" url="index.php" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
|
|
</rule>
|
|
<rule name="Joomla! Rule 2">
|
|
<match url="(.*)" ignoreCase="false" />
|
|
<conditions logicalGrouping="MatchAll">
|
|
<add input="{URL}" pattern="^/index.php" ignoreCase="true" negate="true" />
|
|
<add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
|
|
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
|
|
</conditions>
|
|
<action type="Rewrite" url="index.php" />
|
|
</rule>
|
|
</rules>
|
|
</rewrite>
|
|
</system.webServer>
|
|
</location>
|
|
</configuration>
|