Script to view authenticated users & mail sending script

[abyantony]

Following script to view the authenticated user, Filename and script location of exim mail queue. We can use to find the spamming activities in exim.

Code: [Select]

echo -en "\nChoose from the following options:\n\n 1. auth_id\n 2. X-PHP-Filename\n 3. X-PHP-Script\n\n:"; read a; if [[ a -eq 1 ]]; then x=auth_id; elif [[ a -eq 2 ]]; then x=X-PHP-Filename; elif [[ a -eq 3 ]]; then x=X-PHP-Script; else echo "Ivalid option"; fi; exim -bp | grep "<" | awk '{print $3}' | xargs -n1 exim -Mvh | grep "$x" | sort -n | uniq -c | sort -n

For Example:

root@host [/home/usanunch/public_html]# echo -en "\nChoose from the following options:\n\n 1. auth_id\n 2. X-PHP-Filename\n 3. X-PHP-Script\n\n:"; read a; if [[ a -eq 1 ]]; then x=auth_id; elif [[ a -eq 2 ]]; then x=X-PHP-Filename; elif [[ a -eq 3 ]]; then x=X-PHP-Script; else echo "Ivalid option"; fi; exim -bp | grep "<" | awk '{print $3}' | xargs -n1 exim -Mvh | grep "$x" | sort -n | uniq -c | sort -n

Choose from the following options:

 1. auth_id
 2. X-PHP-Filename
 3. X-PHP-Script

:1
     84 -auth_id usanunch



root@host [/home/usanunch/public_html]# echo -en "\nChoose from the following options:\n\n 1. auth_id\n 2. X-PHP-Filename\n 3. X-PHP-Script\n\n:"; read a; if [[ a -eq 1 ]]; then x=auth_id; elif [[ a -eq 2 ]]; then x=X-PHP-Filename; elif [[ a -eq 3 ]]; then x=X-PHP-Script; else echo "Ivalid option"; fi; exim -bp | grep "<" | awk '{print $3}' | xargs -n1 exim -Mvh | grep "$x" | sort -n | uniq -c | sort -n

Choose from the following options:

 1. auth_id
 2. X-PHP-Filename
 3. X-PHP-Script

:2



root@host [/home/usanunch/public_html]# echo -en "\nChoose from the following options:\n\n 1. auth_id\n 2. X-PHP-Filename\n 3. X-PHP-Script\n\n:"; read a; if [[ a -eq 1 ]]; then x=auth_id; elif [[ a -eq 2 ]]; then x=X-PHP-Filename; elif [[ a -eq 3 ]]; then x=X-PHP-Script; else echo "Ivalid option"; fi; exim -bp | grep "<" | awk '{print $3}' | xargs -n1 exim -Mvh | grep "$x" | sort -n | uniq -c | sort -n

Choose from the following options:

 1. auth_id
 2. X-PHP-Filename
 3. X-PHP-Script

:3
     84 149  X-PHP-Script: test.com/wp-content/plugins/ups-woocommerce-shipping-method/ups-woocommerce-shipping-method/func/oracle.php for 192.x.x.186