close ad
WARNING: Do Not Install the DREAMWEAVER CC 2017 or 2018 Update »
open ad
View Menu

Technical Support Forums

Free, outstanding support from WebAssist and your colleagues

rating

Hackers somehow using mail_php.php

Thread began 9/03/2017 9:21 pm by Steve | Last modified 9/22/2017 1:44 pm by Ray Borduin | 101 views | 11 replies |

Steve

Hackers somehow using mail_php.php

We all fight Spammers using our forms to send spam as Contact emails.
We use reCaptcha, honeypots and anything else we can think up to thwart the automated spamming of our Customers.

Now I have a spammer sending daily emails which look to come from the mail_php.php file.
How they are doing this is beyond my comprehension.

1st I saw some of my other customer get spams and one noted "testing XRumer" in one of the fields. Cool, I'll research this to see what they can do.
Turns out a lot. XRumer can bypass reCatchas and HoneyPots.

So I decided to change the comment field id from "message" to "34rrSGD" and make the honeypot field "comment".
Next our code says IF comment field has values ignore sending an email and setting the post as a DB record.
Lastly we change the title for column 34rrSGD to Comments in the final email.

There is no longer any field named "message".

BUT we are still getting emails sent to the Customer in the original email format and using the "message" field.

We DO see legitimate Contact Submissions posting to the DB and also swapping out 34rrSGD to Comments.
The "Blank" template being assigned to the email response has been changed. We now hide the hidden consent field ($remove[] = "hdn-consent";)
There is NO message input
and we swap out 34rrSGD with Comments
if ($pkey == "34rrSGD") $pkey = "Comments";

Yet there is an email generated multiple times per day, coming from our server, using the old non-existent template.

I can only think that the Bad Guys somehow also send themselves a copy of the originally formatted email response and are now resending that but with different content each day.

Problem is the mail server logs show it's coming from our server AND the email headers are saying it's coming from mail_php.php
"X-PHP-Originating-Script: 0:mail_php.php"

I've attached a screen shot showing the spoofed email content and the latest legitimate one.

How could this be happening?

Sign in to reply to this post

Steve

UPDATE

So here is what we received recently (see screen shots). I changed the "blank" email template to have three asterixis as shown here:

***Details are also saved to DB for later use

Also there is NO input on the Contact form with the Id or Name of "message" yet it shows in the final recieved email.

Additionally, the Blank template page using the $remove[] method to exclude "hdn-consent" from the final email but it is not coming into play as this shows in the final email.

Still at al loss on how they could be sending / submitting these forms when they show field values not present and now even reference a recent update of "***Details are also..."




<?php
$remove = array();
$remove[] = "";
$remove[] = "x";
$remove[] = "y";
$remove[] = "hdn-consent";
$remove[] = "comment";

$removeBegins = array();
$removeBegins[] = "Security";

$removeEnds = array();
$removeEnds[] = "_x";
$removeEnds[] = "_y";

$removeIncludes = array();
$removeIncludes[] = "Security";
?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Blank Template</title>
</head>
<body style="padding: 20px; text-align: center;">
<div id="background" style="padding: 20px; text-align: center; font-size: 12px; width:97%">
<div id="page" style="padding: 5px; margin: 0 auto; width: 660px; text-align: left;">
<div id="header" style="padding: 10px;">
<h1 style="padding: 0px; margin: 0px 0px 2px 0px; font-size: 18px; text-decoration: none; font-weight: bold;">MH Only Submission</h1>
<p style="padding: 0px; margin: 0px 0px 2px 0px;">***Details are also saved to DB for later use</p>
</div>
<div id="contentWrapper" style="padding: 0px 0px 40px 0px;">
<div id="contentHeader">
<table cellpadding="0" cellspacing="0" border="0">
<tr valign="top">
<th style="font-size: 12px; width: 134px; text-align: right; padding: 3px 10px 3px 3px; font-weight: bold;">Form Submitted:</th>
<td style="font-size: 12px; padding: 3px;"><?php $now = time(); ?><?php echo date("n-j-Y", $now); ?>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;<?php echo date("g:i A T", $now); ?></td>
</tr>
</table>
</div>
<div id="content" style="padding: 10px 10px 10px 0px;">

<table cellpadding="0" cellspacing="0" border="0">
<?php
foreach( $_POST as $pkey => $pval ){
if (!RemoveValue($pkey,$remove,$removeBegins,$removeEnds,$removeIncludes)) {
if (get_magic_quotes_gpc()) $pval = stripslashes((is_array($pval)?implode(", ",$pval):$pval));
if ($pkey == "34rrSGD") $pkey = "Comments";
?>
<tr valign="top">
<th style="font-size: 12px; width: 134px; text-align: right; padding: 3px 10px 3px 3px; font-weight: bold;"><?php echo(str_replace("_"," ",$pkey)); ?>:</th>
<td style="font-size: 12px; padding: 3px;"><?php echo(str_replace("\n","<BR />",(is_array($pval)?implode(", ",$pval):$pval))); ?></td>
</tr>
<?php
}
}
?>

</table>
</div>
</div>
</div>
</div>
</body>
</html>
Sign in to reply to this post

Ray BorduinWebAssist

I don't see any server validation code on the CAPTCHA. It would be easy to create a page that posts to this one that would send an email. You really need to validate the CAPTCHA server side for it to do much good.

I'd make sure to validate your CAPTCHA on the server. That would probably stop the problem. If not, the next step might be to log all of the $_SERVER[] variables from the spammer to see if it might contain more details you can use to catch and block them.

Sign in to reply to this post

Steve

Thanks Ray,
I'll try the following. Create a unique value set to a Session and then checked on Post.
Otherwise if you have an alternative suggestion it could be of benefit to others as I did not know the mail_php.php page could be remotely accessed to process emails.

<?php $dateTime = date('Y-m-d h:i:s'); ?>
<?php
$rand = md5(mt_rand());
$hash = sha1($dateTime . $rand);

@session_start();
if (!isset($_SESSION['hash'])){
$_SESSION['hash'] = $hash;
}
?>



Then use the current Honeypot plus look to see if the same values as the $_SESSION is the same as stored and submitted as $_POST['dateTime']

<?php // Honeypot and Same server check
if (empty($_POST['comment']) && $_SESSION['hash'] == $_POST['dateTime']) {
?>





Hidden Field:

<input name="dateTime" type="hidden" id="dateTime" value="<?php echo $_SESSION['hash']; ?>">
Sign in to reply to this post

Ray BorduinWebAssist

The mail page isn't being accessed directly. It only has functions, so something needs to call them. They are probably just posting their own form to your page.

I think your solution should help. How many spam messages are sent per day?

Sign in to reply to this post

Steve

Only a couple messages per day. Not worth the effort to do a custom job so expecting they are using a Program like XRumer to achieve this.
https://en.wikipedia.org/wiki/XRumer

Sign in to reply to this post

Steve

No Spam messages today...

Is there an FAQ area where we should have information on Security? For instance, I now need to make sure ALL forms that send emails are server side validated as a security precaution.

Injections and other even more critical necessary practices could benefit from a Security FAQ.

Sign in to reply to this post

Ray BorduinWebAssist

I don't really have a designated place for that. Server Validation is the only true validation. Client validation can always be bypassed.

Sign in to reply to this post

Steve

Anyone have a working server side screening snippet?

As noted, some blackhats are able to post emails without using my form or using my form in some manner.

They are posting an email format (template) that no longer exists.
They are getting past basic honeypot screening ( if (empty($_POST['comment'])) { ) comment being the trap and if filled don't process the email
Next I set a Session and if not present don't allow the form to process:

<?php
$dateTime = date('Y-m-d h:i:s');
$rand = md5(mt_rand());
$hash = sha1($dateTime . $rand);

@session_start();
if (!isset($_SESSION['hash'])){
$_SESSION['hash'] = $hash;
}
//echo $_SESSION['hash'];
?>

<?php // Honeypot and Same server check
if (empty($_POST['comment']) && isset($_SESSION['hash'])) {
?>



I used to match the $hash variable from a hidden form input but that did not properly match on first page load.
Now I'm just looking for a $_SESSION value which should only happen when the form is accessed locally.

BUT they are still sending emails....

Sign in to reply to this post

Ray BorduinWebAssist

The session will always exist because it is defined above. You would have to switch the order for that to do anything.

Why not do a CAPTCHA server side using the one from webassist? The previous technique of putting the hash into a hidden form element was a good solution as well. I don't quite understand why you would remove it. Why would it need to match on first page load? Wouldn't you only need it to match after the form submits to send the email?

Sign in to reply to this post
loading

Build websites with a little help from your friends

Your friends over here at WebAssist! These Dreamweaver extensions will assist you in building unlimited, custom websites.

Build websites from already-built web applications

These out-of-the-box solutions provide you proven, tested applications that can be up and running now.  Build a store, a gallery, or a web-based email solution.

Want your website pre-built and hosted?

Close Windowclose

Rate your experience or provide feedback on this page

Account or customer service questions?
Please user our contact form.

Need technical support?
Please visit support to ask a question

Content

rating

Layout

rating

Ease of use

rating

security code refresh image

We do not respond to comments submitted from this page directly, but we do read and analyze any feedback and will use it to help make your experience better in the future.

Close Windowclose

We were unable to retrieve the attached file

Close Windowclose

Attach and remove files

add attachmentAdd attachment
Close Windowclose

Enter the URL you would like to link to in your post

Close Windowclose

This is how you use right click RTF editing

Enable right click RTF editing option allows you to add html markup into your tutorial such as images, bulleted lists, files and more...

-- click to close --

Uploading file...