Hackers somehow using mail_php.php

We all fight Spammers using our forms to send spam as Contact emails.
We use reCaptcha, honeypots and anything else we can think up to thwart the automated spamming of our Customers.

Now I have a spammer sending daily emails which look to come from the mail_php.php file.
How they are doing this is beyond my comprehension.

1st I saw some of my other customer get spams and one noted "testing XRumer" in one of the fields. Cool, I'll research this to see what they can do.
Turns out a lot. XRumer can bypass reCatchas and HoneyPots.

So I decided to change the comment field id from "message" to "34rrSGD" and make the honeypot field "comment".
Next our code says IF comment field has values ignore sending an email and setting the post as a DB record.
Lastly we change the title for column 34rrSGD to Comments in the final email.

There is no longer any field named "message".

BUT we are still getting emails sent to the Customer in the original email format and using the "message" field.

We DO see legitimate Contact Submissions posting to the DB and also swapping out 34rrSGD to Comments.
The "Blank" template being assigned to the email response has been changed. We now hide the hidden consent field ($remove[] = "hdn-consent";)
There is NO message input
and we swap out 34rrSGD with Comments
if ($pkey == "34rrSGD") $pkey = "Comments";

Yet there is an email generated multiple times per day, coming from our server, using the old non-existent template.

I can only think that the Bad Guys somehow also send themselves a copy of the originally formatted email response and are now resending that but with different content each day.

Problem is the mail server logs show it's coming from our server AND the email headers are saying it's coming from mail_php.php
"X-PHP-Originating-Script: 0:mail_php.php"

I've attached a screen shot showing the spoofed email content and the latest legitimate one.

How could this be happening?

So here is what we received recently (see screen shots). I changed the "blank" email template to have three asterixis as shown here:

***Details are also saved to DB for later use

Also there is NO input on the Contact form with the Id or Name of "message" yet it shows in the final recieved email.

Additionally, the Blank template page using the $remove[] method to exclude "hdn-consent" from the final email but it is not coming into play as this shows in the final email.

Still at al loss on how they could be sending / submitting these forms when they show field values not present and now even reference a recent update of "***Details are also..."

<?php
$remove = array();
$remove[]  = "";
$remove[]  = "x";
$remove[]  = "y";
$remove[] = "hdn-consent";
$remove[] = "comment";

$removeBegins = array();
$removeBegins[] = "Security";

$removeEnds = array();
$removeEnds[] = "_x";
$removeEnds[] = "_y";

$removeIncludes = array();
$removeIncludes[] = "Security";
?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Blank Template</title>
</head>
<body style="padding: 20px; text-align: center;">
  <div id="background" style="padding: 20px; text-align: center; font-size: 12px; width:97%">
	<div id="page" style="padding: 5px; margin: 0 auto; width: 660px; text-align: left;">
		<div id="header" style="padding: 10px;">
        	<h1 style="padding: 0px; margin: 0px 0px 2px 0px; font-size: 18px; text-decoration: none; font-weight: bold;">MH Only Submission</h1>
            <p style="padding: 0px; margin: 0px 0px 2px 0px;">***Details are also saved to DB for later use</p>
        </div>
        <div id="contentWrapper" style="padding: 0px 0px 40px 0px;">
        	<div id="contentHeader">
            	<table cellpadding="0" cellspacing="0" border="0">
					<tr valign="top">
                    	<th style="font-size: 12px; width: 134px; text-align: right; padding: 3px 10px 3px 3px; font-weight: bold;">Form Submitted:</th>
						<td style="font-size: 12px; padding: 3px;"><?php $now = time(); ?><?php echo date("n-j-Y", $now); ?>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;<?php echo date("g:i A T", $now); ?></td>
					</tr>
				</table>
            </div>
            <div id="content" style="padding: 10px 10px 10px 0px;">
            
            	<table cellpadding="0" cellspacing="0" border="0">
<?php
foreach( $_POST as $pkey => $pval ){
  if (!RemoveValue($pkey,$remove,$removeBegins,$removeEnds,$removeIncludes))  {
	  if (get_magic_quotes_gpc()) $pval = stripslashes((is_array($pval)?implode(", ",$pval):$pval));
      if ($pkey == "34rrSGD") $pkey = "Comments";
?>
					<tr valign="top">
                    	<th style="font-size: 12px; width: 134px; text-align: right; padding: 3px 10px 3px 3px; font-weight: bold;"><?php echo(str_replace("_"," ",$pkey)); ?>:</th>
						<td style="font-size: 12px; padding: 3px;"><?php echo(str_replace("\n","<BR />",(is_array($pval)?implode(", ",$pval):$pval))); ?></td>
					</tr>
<?php
  }
}
?>
					
				</table>
            </div>
        </div>
    </div>
  </div>
</body>
</html>

I don't see any server validation code on the CAPTCHA. It would be easy to create a page that posts to this one that would send an email. You really need to validate the CAPTCHA server side for it to do much good.

I'd make sure to validate your CAPTCHA on the server. That would probably stop the problem. If not, the next step might be to log all of the $_SERVER[] variables from the spammer to see if it might contain more details you can use to catch and block them.

Thanks Ray,
I'll try the following. Create a unique value set to a Session and then checked on Post.
Otherwise if you have an alternative suggestion it could be of benefit to others as I did not know the mail_php.php page could be remotely accessed to process emails.

<?php $dateTime = date('Y-m-d h:i:s'); ?>
<?php
$rand = md5(mt_rand());
$hash = sha1($dateTime . $rand);

@session_start();
if (!isset($_SESSION['hash'])){
  $_SESSION['hash'] = $hash;  
}
?>

Then use the current Honeypot plus look to see if the same values as the $_SESSION is the same as stored and submitted as $_POST['dateTime']

<?php // Honeypot and Same server check
if (empty($_POST['comment']) && $_SESSION['hash'] == $_POST['dateTime']) {
?>

Hidden Field:

<input name="dateTime" type="hidden" id="dateTime" value="<?php echo $_SESSION['hash']; ?>">

The mail page isn't being accessed directly. It only has functions, so something needs to call them. They are probably just posting their own form to your page.

I think your solution should help. How many spam messages are sent per day?

Only a couple messages per day. Not worth the effort to do a custom job so expecting they are using a Program like XRumer to achieve this.
https://en.wikipedia.org/wiki/XRumer

No Spam messages today...

Is there an FAQ area where we should have information on Security? For instance, I now need to make sure ALL forms that send emails are server side validated as a security precaution.

Injections and other even more critical necessary practices could benefit from a Security FAQ.

I don't really have a designated place for that. Server Validation is the only true validation. Client validation can always be bypassed.

Anyone have a working server side screening snippet?

As noted, some blackhats are able to post emails without using my form or using my form in some manner.

They are posting an email format (template) that no longer exists.
They are getting past basic honeypot screening ( if (empty($_POST['comment'])) { ) comment being the trap and if filled don't process the email
Next I set a Session and if not present don't allow the form to process:

<?php
$dateTime = date('Y-m-d h:i:s'); 
$rand = md5(mt_rand());
$hash = sha1($dateTime . $rand);

@session_start();
if (!isset($_SESSION['hash'])){
  $_SESSION['hash'] = $hash;  
 }
//echo $_SESSION['hash'];
?>

<?php // Honeypot and Same server check
if (empty($_POST['comment']) && isset($_SESSION['hash'])) {
?>

I used to match the $hash variable from a hidden form input but that did not properly match on first page load.
Now I'm just looking for a $_SESSION value which should only happen when the form is accessed locally.

BUT they are still sending emails....

The session will always exist because it is defined above. You would have to switch the order for that to do anything.

Why not do a CAPTCHA server side using the one from webassist? The previous technique of putting the hash into a hidden form element was a good solution as well. I don't quite understand why you would remove it. Why would it need to match on first page load? Wouldn't you only need it to match after the form submits to send the email?

Email me with all replies to this thread

Title:

Public Message: (viewable by anyone reading this thread)
(do not cut and paste code into this field unless necessary, attach copies of your pages so they can be opened in Dreamweaver for debugging)

Type in the characters exactly as displayed below - if you don't complete the Captcha correctly you will get a blank page, so you may want to copy the text of your message before you submit!

Quote message in reply?

Private Message: (viewable only by you, the person you are replying to, and WebAssist employees)
(only put truly private information in this area such as ftp details and phone numbers. Keep as much of your post public as possible)

These attachments are private (viewable only by you, the person you are replying to, and WebAssist employees)

Manage Attachments

Technical Support Forums

Free, outstanding support from WebAssist and your colleagues

9/03/2017 6:21 pm | #1 Steve