Re: [fsug-tvm] Spamming Script from OpenCart Project
"Manu Krishnan T.V" <[email protected]> Wed, 17 Feb 2016 13:19:23 +0530
| Newsgroups | gmane.org.user-groups.linux.ilug-tvm,gmane.org.fsf.india.fsf-friends |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --------------030504030407000309030108 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi, This is a common issue with popular web applications like wordpress and opencart, exploiting vulnerabilities in either plugin or themes. These spamming scripts mainly abuse the php mail function. So, the first step is to disable php mail and use SMTP for all mails. Once mail is disabled, all requests to mail function can be logged as an error. Do a fresh installation of opencart and once the malicious script is injected again through any vulnerability, the requests to mail function will be in the error log. Look for access and error logs for the nearby date/hours to figure out how exactly the file was injected. Once you get an idea of how it is happening, install an intrusion detection software like fail2ban to block any malicious requests. On Wednesday 17 February 2016 10:24 AM, JeevZ wrote: > Hello, > > This is an offtopic, a help seeking message. > > We have done a project on OpenCart which is residing in our VPS. > Somehowm one malicious script is creating Spam Emails. We have found > out that php file and cleared it. But this repeats again and > dynamically such spam sending scripts are being generated. This makes > entire vps server fail and other serious problems. > > We have inspected for base64 encryption and other normal method find > such malicious code but none to find. We have changed passwords > several times but still the issue persists. > > > Is there any one here who has some experience on this ? the problem is > we cannot locate which files creates spam sending scripts dynamically. > > > please help > > > thank you > > > ** > Jai Bhim > -- JeevZ -- > > *Jeevachaithanyan Sivanandan > +919446196667 > http://jeevanism.wordpress.com/ > -- I Take Refuge On The Enlightened Wisdom -- > -- =E0=B4=AC=E0=B5=81=E0=B4=A6=E0=B5=8D=E0=B4=A7=E0=B4=82,=E0=B4=A7=E0=B5= =BC=E0=B4=AE=E0=B4=82, =E0=B4=B8=E0=B4=82=E0=B4=98=E0=B4=82 =E0=B4=B6=E0= =B4=B0=E0=B4=A3=E0=B4=82 =E0=B4=97=E0=B4=9A=E0=B5=8D=E0=B4=9B=E0=B4=BE=E0= =B4=AE=E0=B4=BF -- > * > > > > > > > > This email has been sent from a virus-free computer protected by Avast. > www.avast.com <https://www.avast.com/sig-email> > > --=20 > --=20 > "Freedom is the only law". > "Freedom Unplugged" > http://www.ilug-tvm.org > =20 > You received this message because you are subscribed to the Google > Groups "ilug-tvm" group. > To control your subscription visit > http://groups.google.co.in/group/ilug-tvm/subscribe > To post to this group, send email to ilug-tvm-/[email protected] > To unsubscribe from this group, send email to > ilug-tvm-unsubscribe-/[email protected] > =20 > =20 > =20 > For details visit the google group page: > http://groups.google.com/group/ilug-tvm?hl=3Den > > --- > You received this message because you are subscribed to the Google > Groups "Free Software Users Group, Thiruvananthapuram" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to ilug-tvm+unsubscribe-/[email protected] > <mailto:ilug-tvm+unsubscribe-/[email protected]>. > For more options, visit https://groups.google.com/d/optout. --=20 Regards, Manu Krishnan T V Co-Founder | DayScholars Innovations <http://www.dayscholars.com> SysAdmin | Cool-Works Web Solutions <http://www.coolwrks.com> Blogs at Bizzard.info <http://www.bizzard.info> & can be found in social networks as *@tvmanukrishnan <http://www.twitter.com/tvmanukrishnan>* --=20 --=20 "Freedom is the only law".=20 "Freedom Unplugged" http://www.ilug-tvm.org You received this message because you are subscribed to the Google Groups "ilug-tvm" group. To control your subscription visit http://groups.google.co.in/group/ilug-tv= m/subscribe To post to this group, send email to ilug-tvm-/[email protected] To unsubscribe from this group, send email to ilug-tvm-unsubscribe-/[email protected] For details visit the google group page: http://groups.google.com/group/ilu= g-tvm?hl=3Den ---=20 You received this message because you are subscribed to the Google Groups "= Free Software Users Group, Thiruvananthapuram" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to ilug-tvm+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected] For more options, visit https://groups.google.com/d/optout. --------------030504030407000309030108 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <html> <head> <meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Type= "> </head> <body bgcolor=3D"#FFFFFF" text=3D"#000000"> <div class=3D"moz-cite-prefix">Hi,<br> <br> This is a common issue with popular web applications like wordpress and opencart, exploiting vulnerabilities in either plugin or themes. These spamming scripts mainly abuse the php mail function. So, the first step is to disable php mail and use SMTP for all mails. Once mail is disabled, all requests to mail function can be logged as an error.<br> <br> Do a fresh installation of opencart and once the malicious script is injected again through any vulnerability, the requests to mail function will be in the error log. Look for access and error logs for the nearby date/hours to figure out how exactly the file was injected. Once you get an idea of how it is happening, install an intrusion detection software like fail2ban to block any malicious requests.<br> <br> <br> On Wednesday 17 February 2016 10:24 AM, JeevZ wrote:<br> </div> <blockquote cite=3D"mid:CA+f5809MLj6z1QsWEzXY87hE2Np6mPNikVjT=3DwKH6376mAyT7w-JsoAwUIsXov1KXRcyAk9cg@public.gmane.org= l.com" type=3D"cite"> <div dir=3D"ltr"> <div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">Hello,<br> <br> </div> <div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">This is an offtopic, a help seeking message. <br> <br> </div> <div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">We have done a project on OpenCart which is residing in our VPS. Somehowm one malicious script is creating Spam Emails. We have found out that php file and cleared it. But this repeats again and dynamically such spam sending scripts are being generated. This makes entire vps server fail and other serious problems. <br> <br> </div> <div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">We have inspected for base64 encryption and other normal method find such malicious code but none to find. We have changed=C2=A0 passwords several times b= ut still the issue persists.<br> <br> <br> </div> <div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">Is there any one here who has some experience on this ? the problem is we cannot locate which files creates spam sending scripts dynamically. <br> <br> <br> </div> <div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">please help<br> <br> <br> </div> <div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small">thank you <br> </div> <div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif;font-size:small"><br> <br clear=3D"all"> </div> <div> <div class=3D"gmail_signature">**<br> Jai Bhim<br> -- JeevZ --<br> <br> *Jeevachaithanyan Sivanandan<br> +919446196667<br> <a moz-do-not-send=3D"true" href=3D"http://jeevanism.wordpress.com/" target=3D"_blank">ht= tp://jeevanism.wordpress.com/</a><br> -- I Take Refuge On The Enlightened Wisdom --<br> -- =E0=B4=AC=E0=B5=81=E0=B4=A6=E0=B5=8D=E0=B4=A7=E0=B4=82,=E0= =B4=A7=E0=B5=BC=E0=B4=AE=E0=B4=82, =E0=B4=B8=E0=B4=82=E0=B4=98=E0=B4=82=C2= =A0 =E0=B4=B6=E0=B4=B0=E0=B4=A3=E0=B4=82 =E0=B4=97=E0=B4=9A=E0=B5=8D=E0=B4= =9B=E0=B4=BE=E0=B4=AE=E0=B4=BF -- <br> *<br> <br> <br> <br> <br> <br> <br> </div> </div> </div> <div id=3D"DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br> <table style=3D"border-top:1px solid #aaabb6"> <tbody> <tr> <td style=3D"width:470px;padding-top:20px;color:#41424e;font-size:13px;font-fam= ily:Arial,Helvetica,sans-serif;line-height:18px">This email has been sent from a virus-free computer protected by Avast. <br> <a moz-do-not-send=3D"true" href=3D"https://www.avast.com/sig-email" target=3D"_blank= " style=3D"color:#4453ea">www.avast.com</a> </td> </tr> </tbody> </table> </div> -- <br> -- <br> "Freedom is the only law". <br> "Freedom Unplugged"<br> <a moz-do-not-send=3D"true" href=3D"http://www.ilug-tvm.org">http://w= ww.ilug-tvm.org</a><br> =C2=A0<br> You received this message because you are subscribed to the Google<br= > Groups "ilug-tvm" group.<br> To control your subscription visit <a moz-do-not-send=3D"true" href=3D"http://groups.google.co.in/group/ilug-tvm/subscribe">http:/= /groups.google.co.in/group/ilug-tvm/subscribe</a><br> To post to this group, send email to <a class=3D"moz-txt-link-abbrevi= ated" href=3D"mailto:ilug-tvm-/[email protected]">ilug-tvm-/[email protected]</= a><br> To unsubscribe from this group, send email to<br> <a class=3D"moz-txt-link-abbreviated" href=3D"mailto:ilug-tvm-unsubsc= ribe-/[email protected]">ilug-tvm-unsubscribe-/[email protected]</a><br> =C2=A0<br> =C2=A0<br> =C2=A0<br> For details visit the google group page: <a moz-do-not-send=3D"true" href=3D"http://groups.google.com/group/ilug-tvm?hl=3Den"><a class= =3D"moz-txt-link-freetext" href=3D"http://groups.google.com/group/ilug-tvm?= hl=3Den">http://groups.google.com/group/ilug-tvm?hl=3Den</a></a><br> <br> --- <br> You received this message because you are subscribed to the Google Groups "Free Software Users Group, Thiruvananthapuram" group.<br> To unsubscribe from this group and stop receiving emails from it, send an email to <a moz-do-not-send=3D"true" href=3D"mailto:ilug-tvm+unsubscribe-/[email protected]">ilug-tvm+unsu= bscribe-/[email protected]</a>.<br> For more options, visit <a moz-do-not-send=3D"true" href=3D"https://groups.google.com/d/optout">https://groups.google.c= om/d/optout</a>.<br> </blockquote> <br> <br> <div class=3D"moz-signature">-- <br> <style> a, a:hover, a:active { color: #888; text-decoration: none; font-weight: bol= d; } </style>Regards,<br> Manu Krishnan T V<br> <br> <small> Co-Founder | <a href=3D"http://www.dayscholars.com">DaySchola= rs Innovations</a><br> SysAdmin | <a href=3D"http://www.coolwrks.com">Cool-Works Web Solutions</a><br> Blogs at <a href=3D"http://www.bizzard.info">Bizzard.info</a> & can be found in social networks as <b><a href=3D"http://www.twitter.com/tvmanukrishnan">@tvmanukrishnan<= /a></b> </small> </div> </body> </html> <p></p> -- <br /> -- <br /> "Freedom is the only law". <br /> "Freedom Unplugged"<br /> <a href=3D"http://www.ilug-tvm.org">http://www.ilug-tvm.org</a><br /> <br /> You received this message because you are subscribed to the Google<br /> Groups "ilug-tvm" group.<br /> To control your subscription visit <a href=3D"http://groups.google.co.in/gr= oup/ilug-tvm/subscribe">http://groups.google.co.in/group/ilug-tvm/subscribe= </a><br /> To post to this group, send email to ilug-tvm-/[email protected]<br /> To unsubscribe from this group, send email to<br /> ilug-tvm-unsubscribe-/[email protected]<br /> <br /> <br /> <br /> For details visit the google group page: <a href=3D"http://groups.google.co= m/group/ilug-tvm?hl=3Den">http://groups.google.com/group/ilug-tvm?hl=3Den</= a><br /> <br /> --- <br /> You received this message because you are subscribed to the Google Groups &= quot;Free Software Users Group, Thiruvananthapuram" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:ilug-tvm+unsubscribe-/[email protected]">ilug-tvm+u= nsubscribe-/[email protected]</a>.<br /> For more options, visit <a href=3D"https://groups.google.com/d/optout">http= s://groups.google.com/d/optout</a>.<br /> --------------030504030407000309030108--