1

I apologize if this is already asked a million times.

One of accounts on my server got hacked. An email spam sending script is injected and sending ton of emails to some random addresses.

I have cPanel/WHM on my server WHM 11.38.0 (build 5) Also it is CENTOS 5.9 x86_64

I usually don't use cPanel nor WHM I have it on this server from the start and later I was too busy to setup an non WHM based server.

What I did up until now:

  1. I blocked problematic account from sending emails at all from WHM
  2. I executed this command exim -bp | grep \< | awk '{print $3}' | xargs exim -Mrm since I got 70k emails in mail queue
  3. I restarted the server

Currently I cant easily change password for that email account.

Is there a way to see what process exactly, or much better what script is sending those mails and where is it located?

Thank you in advance and if you need some additional info to help me just ask.

EDIT

I have looked in crontab for that user and there were nothing suspicious in it. Thank you in advance and if you need some additional info to help me just ask.

EDIT 2

Here is an screenshot of top command executed and I pointed to my suspect: ssh top email spam script

Aside from pointed process there are a lot of "mailnull" processes. What can I do about it?

3 Answers 3

2

If you know the mail account the spam comes from, you will definitely have to change the password. How do you know the spam is sent via some script?

If it is sent via some vulnerable (PHP?-)script, to find out where it comes from, you should create a sendmail wrapper, as scripts are usually using the sendmail binary to send out mails.

Create a file /usr/sbin/sendmail-wrapper with this content:

#!/bin/sh
TODAY=`date -Iseconds`
echo $TODAY sendmail-wrapper called $USER from $PWD >>/tmp/mail.send
(echo X-Additional-Header: $(dirname $PWD);cat) | /usr/sbin/sendmail-real "$@"

To get your wrapper active, move the real sendmail binary:

mv /usr/sbin/sendmail /usr/sbin/sendmail-real

and move the wrapper:

mv /usr/sbin/sendmail-wrapper /usr/sbin/sendmail

Everytime sendmail is called, it will add an additional header to the mail and will log the path sendmail was called from to /tmp/mail.send . This way, you should be able to find the problematic script.

Make sure to put the original sendmail binary back in place afterwards to stop /tmp/mail.send from growing indefinitely.

1
  • Your answer is quite interesting, I will try to do what you described.
    – Develoger
    May 8, 2013 at 20:00
2

Maybe a php script is exploited If you are running php 5.3.x or over set :

mail.add_x_header=1
mail.log=/var/log/phpmail

in php.ini.
Also make sure that /var/log/phpmail is world writeable , so every php process can write it.
Then restart apache.

After this check the headers of outgoing mail's, should contain the name of php script (X-PHP-Originating-Script)

0

can you disable user clubmaga? why can't you change clubmaga's password? have you tried to kill or kill -9 your suspected evil proggy? purge the mail-queue assuming you can? is your system up to date?

Until you know how you were compromised you are still compromised - as far as you know the bad guy is still on the machine and even if not since you are not willing/able to change passwords your machine is still totally available.

Unless you really know what you are doing you should either clean install or restore a backup you know is clean. Anything else will likely have little positive effect as you are still compromised or at least comprisable in the same way that already worked.

1
  • I don't know what to kill because there are a lot of processes that are running exim even from root user. I know that an clean install with clean backups is the best solution but I can't do that now. If there is a way to know where is injected script located that would be perfect :)
    – Develoger
    May 8, 2013 at 19:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .