Here some notes about how to troubleshoot a server that got compromised by a php script.
Check email queue
- Qmail ->
qmHandle - Postfix ->
pmHandle/postqueue
sh
# qmHandle -s
Total messages: 7357
Messages with local recipients: 0
Messages with remote recipients: 7357
Messages with bounces: 0
Messages in preprocess: 0
Get some email IDs
sh
# qmHandle -l | head
1348989 (16, 16/1348989)
Return-path: #@[]
From: [email protected]
To: [email protected]
Subject: failure notice
Date: 30 Jun 2015 07:42:59 +0100
Size: 5093 bytes
less
42240113 (15, 15/42240113)
Return-path: [email protected]
Check for X-PHP header in the mail message Look for the UID and script that sent the message
sh
# qmHandle -m1348989 | grep X-PHP
X-PHP-Originating-Script: 48:wp-content.php(1) : eval()'d code
Find the script and UID
sh
# grep 48 /etc/passwd => this was Apache ==> this means that the code was injected via Apache
=> permissions issue??
sh
# locate wp-content.php
/var/www/vhosts/example.com/wp-content.php
Move away the file(s) and chown 000
!! if the file starts with - , you need to user chown -- 000 filename
Disable execution php following this how to
Delete all the messages containing that header
sh
# qmHandle -h'X-PHP-Originating-Script: 48:wp-content.php'
Calling system script to terminate qmail...
Stopping : Looking for messages with headers matching X-PHP-Originating-Script: 48:wp-content.php
Message 1345933 slotted for deletion.
Message 42240608 slotted for deletion.
Message 1346796 slotted for deletion.
Message 42240391 slotted for deletion.
Message 42241954 slotted for deletion.
[...]
Deleted 113 messages from queue
Restarting qmail... Starting qmail: [ OK ]
done (hopefully).
Extra notes: Check the queue:
sh
postqueue -p
See the content of a message:
sh
postcat -q <ID from postqueue output>
Check for "X-PHP-Originating-Script" header, which generally gives you the name of the script that generate the email If they are sent to a specific domain, you can block some domains in Postfix following this guide