cPanel server with Exim MTA and Dovecot. Some hacker is finding old scripts at different users public directory, and uploading base64 encoded files then using it to send massive spam.
How do I block it at the server or Exim config itself, without disabling normal PHP scripts sending legitimate email?

Example of that code http://pastebin.ca/3039339

  • Maybe try to block port 25? it would be your best option against the hacker. – H3lp3ingth3p33ps Jun 28 '15 at 10:15

This most likely means you or your users are using outdated software / applications. The only way to prevent this, is to regularly update and patch this software / applications unless the hacker is using a 0-day exploit that's currently unknown.

Try determining the entry point where this script is uploaded from the web server log files. Once found, inform your user(s) to patch their software / application(s).

If you think you should block this at the "SMTP level", I think you are wrong. When hackers are able to upload and execute malicious PHP files, your server may be (partially) compromised. Try determining the root cause instead of fixing it somewhere else.

I suggest to investigate how much of the server is compromised by means of log files. Worst case, I'd suggest to start from scratch.


yes its obvious the customers have to upgrade the script and its going whack a mole bassis , we keep flagging the user while we disable the script but somehow some dumb user restores old backup or something and this malicious activity repeats. we again go through process of finding the spam then searching the script then blocking the script again messaging the customer, only to find it happen with another user after sometime again repeat the same process , which totally damages IP reputation as its constantly getting blocked.

I totally agree the server needs to be sanatized and scripts upgraded but when you have US$ 1-4 dollar shared hosting where sometimes non-tech savvy people or some kid in school trying to host his project uses old scripts and doesnt u.stand why upgrading is so important, some companies do not want to hire another developer to upgrade the script and constantly tell us at hosting to "FIX THE DAMN ISSUE, Why is your server bad? this is hosting issue, else i will take my business somewhere, I have lost $2000 dollar business cause you disabled my website , i am going to godaddy if you dont enable" instead of fixing the script by upgrading, this is constantly going to happen no matter what we try in telling them to keep scripts upgraded.

I wish There was some auto-disable system within drupal or wordpress itself which kills itself once it is vulnerable. this is the reason i am trying to find a way to do it with Mail MTA itself or some firewall rule or csf or something. ps:sorry about the rant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.