🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: be.comp.security
Article #1339

Re: formmail.cgi hacker ?

#1339
From: M.
Date: Wed, 03 Sep 2003 18:40
125 lines
5819 bytes
formmail.pl of formmail.cgi (same thing) misbruik je als spammer
probleemloos. Upgrade naar formmail.php en al je problemen zijn over:
http://www.boaddrink.com



"Paul Cobbaut" <pol@cobbbbbaut.be> wrote in message
news:3f38da54$0$323$ba620e4c@reader1.news.skynet.be...
Ahoi,

ik heb vandaag (weeral) enkele keren volgende e-mails gekregen.
Ter info, ik gebruik geen forms of CGI.

Weet iemand wat hier gaande is ?
Is die cac719@aol.com op zoek naar open relays ofzo ?

groetjes,
Paul

PS dierenasieltienen.be heb ik gehost bij lazernet.


----------------------------------------------------
----------- deze soort komt om de 24 uur------------

 From - Mon Aug 11 22:42:50 2003
X-UIDL: 57ce7d3e3426f47b3f2f61af4a31e495
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path: <>
Envelope-to: asieltie@krimson.lazernet.be
Delivery-date: Mon, 11 Aug 2003 12:22:20 +0200
Received: from mailnull by krimson.lazernet.be with local (Exim 4.20)
id 19m9oi-0004V7-D7
for asieltie@krimson.lazernet.be; Mon, 11 Aug 2003 12:22:20 +0200
From: Mail Delivery System <Mailer-Daemon@krimson.lazernet.be>
To: asieltie@krimson.lazernet.be
Subject: Warning: message 19kz9E-0007rq-8c delayed 72 hours
Message-Id: <E19m9oi-0004V7-D7@krimson.lazernet.be>
Date: Mon, 11 Aug 2003 12:22:20 +0200

This message was created automatically by mail delivery software.
A message that you sent has not yet been delivered to one or more of its
recipients after more than 72 hours on the queue on krimson.lazernet.be.

The message identifier is:     19kz9E-0007rq-8c
The subject of the message is:
http://www.dierenasieltienen.be/cgi-sys/formmail.pl (200.251.234.160:80)
bcc: cac719@aol.comW IDJZTp x P3p1 7 pc  qKjOSKjKp9 a DGeqJPgh0 ecW Q
  sG O Vf1G 7mtNXRt brip GS umI  qllMi Bd Pt �FFFFCCabcdefghij.
The date of the message is:    Fri, 08 Aug 2003 06:46:40 +0200

The address to which the message has not yet been delivered is:

   xriuiUo8U@www.dierenasieltienen.be
     Delay reason: lowest numbered MX record points to local host

No action is required on your part. Delivery attempts will continue for
some time, and this warning may be repeated at intervals if the message
remains undelivered. Eventually the mail delivery software will give up,
and when that happens, the message will be returned to you.
----------------------------------------------------
----------------------------------------------------


----------------------------------------------------
----- deze soort komt zes keer op 10 minuten--------

 From - Tue Aug 12 13:38:56 2003
X-UIDL: 0060205c320bf101085e99a9e2967c9d
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path: <>
Envelope-to: asieltie@krimson.lazernet.be
Delivery-date: Tue, 12 Aug 2003 13:33:56 +0200
Received: from mailnull by krimson.lazernet.be with local (Exim 4.20)
id 19mXPY-00074z-Jz
for asieltie@krimson.lazernet.be; Tue, 12 Aug 2003 13:33:56 +0200
X-Failed-Recipients: xriuiUo8U@www.dierenasieltienen.be
From: Mail Delivery System <Mailer-Daemon@krimson.lazernet.be>
To: asieltie@krimson.lazernet.be
Subject: Mail delivery failed: returning message to sender
Message-Id: <E19mXPY-00074z-Jz@krimson.lazernet.be>
Date: Tue, 12 Aug 2003 13:33:56 +0200

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

   xriuiUo8U@www.dierenasieltienen.be
     lowest numbered MX record points to local host:
     retry timeout exceeded

------ This is a copy of the message, including all the headers. ------

Return-path: <asieltie@krimson.lazernet.be>
Received: from asieltie by krimson.lazernet.be with local (Exim 4.20)
id 19kz9E-0007rq-8c
for xriuiUo8U@www.dierenasieltienen.be; Fri, 08 Aug 2003 06:46:40 +0200
To: xriuiUo8U@www.dierenasieltienen.be
From: xriuiUo8U@www.dierenasieltienen.be
Subject: http://www.dierenasieltienen.be/cgi-sys/formmail.pl
(200.251.234.160:80) bcc: cac719@aol.comW IDJZTp x P3p1 7 pc  qKjOSKjKp9
a DGeqJPgh0 ecW Q    sG O Vf1G 7mtNXRt brip GS umI  qllMi Bd Pt
�FFFFCCabcdefghij.
Message-Id: <E19kz9E-0007rq-8c@krimson.lazernet.be>
Date: Fri, 08 Aug 2003 06:46:40 +0200

body: W IDJZTp x P3p1 7 pc  qKjOSKjKp9 a DGeqJPgh0 e
cW Q    sG O Vf1G 7mtNXRt brip GS umI  qllMi Bd
Pt �FFFFCCabcdefghij

----------------------------------------------------
----------------------------------------------------




--
Geef verstoten honden een thuis
http://www.dierenasieltienen.be
--
Wij gebruiken linux!
http://www.linux.org
Technical Details
Message-ID: <kAq5b.17859$oA2.748615@phobos.telenet-ops.be>
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-xit-08!supernews.com!newsfeed1.easynews.com!easynews.com!easynews!news-out.nuthinbutnews.com!propagator2-sterling!In.nntp.be!cleanfeed.casema.net!newsfeed.wxs.nl!aotearoa.belnet.be!news.belnet.be!ossa.telenet-ops.be!phobos.telenet-ops.be.POSTED!not-for-mail
References: <3f38da54$0$323$ba620e4c@reader1.news.skynet.be>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII
X-Google-Thread: 113446,d745106449830af
X-Google-Attributes: gid113446,public
X-Google-ArrivalTime: 2003-09-03 11:40:35 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-xit-08!supernews.com!newsfeed1.easynews.com!easynews.com!easynews!news-out.nuthinbutnews.com!propagator2-sterling!In.nntp.be!cleanfeed.casema.net!newsfeed.wxs.nl!aotearoa.belnet.be!news.belnet.be!ossa.telenet-ops.be!phobos.telenet-ops.be.POSTED!not-for-mail
From: "M." <esaelp.m@ps.on>
Newsgroups: be.comp.security
References: <3f38da54$0$323$ba620e4c@reader1.news.skynet.be>
Subject: Re: formmail.cgi hacker ?
Lines: 128
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <kAq5b.17859$oA2.748615@phobos.telenet-ops.be>
Date: Wed, 03 Sep 2003 18:40:16 GMT
NNTP-Posting-Host: 213.118.81.69
X-Complaints-To: abuse@telenet.be
X-Trace: phobos.telenet-ops.be 1062614416 213.118.81.69 (Wed, 03 Sep 2003 20:40:16 MEST)
NNTP-Posting-Date: Wed, 03 Sep 2003 20:40:16 MEST
Organization: Telenet Internet