# DO NOT DO THIS - it will break your mail server!
# sed -i 's/^\[%%zimbraLocalBindAddress%%\]:10027 inet/#...' master.cf.in

printf "EHLO probe.test\r\nMAIL FROM:<[email protected]>\r\nRCPT TO:<x: \$(echo TEST > /opt/zimbra/mailboxd/webapps/zimbra/public/test.txt)>\r\nQUIT\r\n" \
  | nc 127.0.0.1 25
# Expected: 555 5.5.4 Unsupported option OR 501 5.1.3 Bad recipient address syntax

# Verify file was NOT created:
ls /opt/zimbra/mailboxd/webapps/zimbra/public/test.txt
# Expected: No such file or directory = PATCHED ✅

# Regenerate PreAuth Key
su - zimbra -c "zmprov generateDomainPreAuthKey -f yourdomain.com"

# Monitor for webshells every 5 minutes
cat > /root/check_webshell.sh << 'EOF'
#!/bin/bash
WEBDIR="/opt/zimbra/mailboxd/webapps/zimbra/public"
ALERT_EMAIL="[email protected]"
LOGFILE="/var/log/webshell_check.log"

if [ -f "$WEBDIR/version.txt" ]; then
    echo "$(date) - ALERT: version.txt detected!" >> $LOGFILE
    rm -f "$WEBDIR/version.txt"
    echo "SECURITY ALERT: version.txt detected on $(hostname)" | \
      /opt/zimbra/common/sbin/sendmail -f [email protected] $ALERT_EMAIL
fi

find "$WEBDIR" -maxdepth 1 -name "*.jsp" -newer "$WEBDIR/login.jsp" -type f | while read f; do
    echo "$(date) - ALERT: Suspicious JSP: $f" >> $LOGFILE
    rm -f "$f"
    echo "SECURITY ALERT: Suspicious file $f detected" | \
      /opt/zimbra/common/sbin/sendmail -f [email protected] $ALERT_EMAIL
done
EOF
chmod +x /root/check_webshell.sh
echo "*/5 * * * * root /root/check_webshell.sh" > /etc/cron.d/check_webshell