I Managedmanaged to trace the files without rebuilding the whole server which are sending spam emails. This is probably happening because of any phpPHP script that is running on your server. Usually hackers are deploying these scripts that are using eval() methods to execute the php mail code randomly.
- db.php
- functions90.php
- page35.php
- start.pgp
- system31.php -template
- template.php
- title.php
How idid I find these filefiles?
I Enableenabled the Debug option for ssmtp by Addingadding one line in ssmtp.config file DEBUG = YESDEBUG = YES. Then iI went to /var/logs/mail.log/var/logs/mail.log and iI found some content like
[email protected] Jun 21 10:22:54 megatron sSMTP[19726]: To: [email protected] Jun 21 10:22:54 megatron sSMTP[19726]: Subject: I've been thinking of you Jun 21 10:22:54 megatron sSMTP[19726]: X-PHP-Originating-Script: 1002:db.php(1965) : eval()'d code Jun 21 10:22:54 megatron sSMTP[19726]: Date: Tue, 21 Jun 2016 10:22:54 +0100 Jun 21 10:22:54 megatron sSMTP[19726]: Message-ID: [email protected] Jun 21 10:22:54 megatron sSMTP[19726]: X-Priority: 3 Jun 21 10:22:54 megatron sSMTP[19726]: MIME-Version: 1.0 Jun 21 10:22:54 megatron sSMTP[19726]: Content-Type: multipart/alternative;#015#012#011boundary="b1_a27900aabf9e492a7f0f180afaa7902f" Jun 21 10:22:54 megatron sSMTP[19726]: Content-Transfer-Encoding: 8bit Jun 21 10:22:54 megatron sSMTP[19726]: Jun 21 10:22:54 megatron sSMTP[19726]: --b1_a27900aabf9e492a7f0f180afaa7902f Jun 21 10:22:54 megatron sSMTP[19726]: Content-Type: text/plain; charset=us-ascii Jun 21 10:22:54 megatron sSMTP[19726]: Jun 21 10:22:54 megatron sSMTP[19726]: Wanna play with my vibrator in my bedroom? Jun 21 10:22:54 megatron sSMTP[19726]: Jun 21 10:22:54 megatron sSMTP[19726]: Don't break my heart, sweetie! Jun 21 10:22:54 megatron sSMTP[19726]: Jun 21 10:22:54 megatron sSMTP[19726]: Aren't you going to ignore me? Jun 21 10:22:54 megatron sSMTP[19726]:
<[email protected]>
Jun 21 10:22:54 megatron sSMTP[19726]: To: [email protected]
Jun 21 10:22:54 megatron sSMTP[19726]: Subject: I've been thinking of you
Jun 21 10:22:54 megatron sSMTP[19726]: X-PHP-Originating-Script: 1002:db.php(1965) : eval()'d code
Jun 21 10:22:54 megatron sSMTP[19726]: Date: Tue, 21 Jun 2016 10:22:54 +0100
Jun 21 10:22:54 megatron sSMTP[19726]: Message-ID: <[email protected]>
Jun 21 10:22:54 megatron sSMTP[19726]: X-Priority: 3
Jun 21 10:22:54 megatron sSMTP[19726]: MIME-Version: 1.0
Jun 21 10:22:54 megatron sSMTP[19726]: Content-Type: multipart/alternative;#015#012#011boundary="b1_a27900aabf9e492a7f0f180afaa7902f"
Jun 21 10:22:54 megatron sSMTP[19726]: Content-Transfer-Encoding: 8bit
Jun 21 10:22:54 megatron sSMTP[19726]:
Jun 21 10:22:54 megatron sSMTP[19726]: --b1_a27900aabf9e492a7f0f180afaa7902f
Jun 21 10:22:54 megatron sSMTP[19726]: Content-Type: text/plain; charset=us-ascii
Jun 21 10:22:54 megatron sSMTP[19726]:
Jun 21 10:22:54 megatron sSMTP[19726]: Wanna play with my vibrator in my bedroom?
Jun 21 10:22:54 megatron sSMTP[19726]:
Jun 21 10:22:54 megatron sSMTP[19726]: Don't break my heart, sweetie!
Jun 21 10:22:54 megatron sSMTP[19726]:
Jun 21 10:22:54 megatron sSMTP[19726]: Aren't you going to ignore me?
Jun 21 10:22:54 megatron sSMTP[19726]:
Now if you closely look at the 4th line of the Debug log "X-PHP-Originating-Script:"X-PHP-Originating-Script: it is showing that db.phpdb.php is running this script using eval()'d codeeval()'d code.
Solution:
So iI noted down all files found in the logs and then find them by using
find / -name "filename.php" > /var/www/filesSearch.logfind / -name "*filename*.php" > /var/www/filesSearch.log
and delete all files by taking a backup. After deleting the files in the files search log i recheck, I rechecked all of my foldersfolders' permissions.
You must need to check all of the www folder permissions again and keep most of them to 755 or 644. If you are uploading any file using website then please don't allow to upload php,sh sh or server-side executable files.
