![]() |
| |||||||
![]() |
| | LinkBack | Thread Tools | Search this Thread | Display Modes |
| |||
| Hi folks I've given myself a nice little exercise to help renovate some very rusty basic C- skills. Scenario: one machine running apache with perl/cgi scripts and php scripts calling the mail function. (qmail) some of these scripts are being abused by spammers. Goal: To play with qmail code so the X-headers show the uid of the calling script's owner and the name of the script itself. The plan is to traverse the pstree using /proc/(pidno)/status to get ppids and prog names. I realise I may have to move a way back up the tree to the apache process and then back down thru that process to find other processes it is running (including the calling script)... ....However: I have noticed when running pstree, I see ---httpd--mailer.cgi and I see lots of ---qmail-inject --- qmail-queue and so on, but I never see the tree showing the mailer.cgi script or even its apache process as the parent of the qmail-inject (or sendmail) progs. What is the mechanism by which a php or perl script calls the mail function without appearing as the mail function's parent? It is possible that someone could save me a lot of wasted time and effort here. I like the challenge, but I'd like a chance of at least partial success. If a run a snapshot of the process table at the time the mail is being inject, will I ever see any link between the injction process and the "calling" script? Thanks ppl Andy |
![]() |
| Thread Tools | Search this Thread |
| Display Modes | |
| |