www user hacked 10.3.9

[airjosh]

I am running 10.3.9 server on an xserve- currently this is the setup for my mail server

Accept SMTP relays is NOT checked, which as I understand it should force people trying to send mail to authenticate

In localhost aliases I have all of the domains that utilize the mail server.

SMTP is set to require authentication, but am not using SSL

If I watch the queue using mailq, the www user will try to send out spam email to hundreds of addresses. I searched here and found that this would be an exploit on my system that has a script running.

I grep’d www and came up with the following process

cyrus 22314 3.0 0.1 28656 644 ?? Ss 2:09PM 0:00.01 /usr/bin/cyrus/bin/deliver -e -r www@domainonmyserver.com -m aphod

I can end the process, but how do I locate the script or exploit that continues to start this process?

Any help would be most appreciated, it has taken me a couple of days to get this far.

[Author]

Posts