Article View: be.comp.security
Article #1378formmail.cgi hacker ?
From: Paul Cobbaut
Date: Tue, 12 Aug 2003 12:14
Date: Tue, 12 Aug 2003 12:14
117 lines
5361 bytes
5361 bytes
Ahoi,
ik heb vandaag (weeral) enkele keren volgende e-mails gekregen.
Ter info, ik gebruik geen forms of CGI.
Weet iemand wat hier gaande is ?
Is die cac719@aol.com op zoek naar open relays ofzo ?
groetjes,
Paul
PS dierenasieltienen.be heb ik gehost bij lazernet.
----------------------------------------------------
----------- deze soort komt om de 24 uur------------
From - Mon Aug 11 22:42:50 2003
X-UIDL: 57ce7d3e3426f47b3f2f61af4a31e495
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path: <>
Envelope-to: asieltie@krimson.lazernet.be
Delivery-date: Mon, 11 Aug 2003 12:22:20 +0200
Received: from mailnull by krimson.lazernet.be with local (Exim 4.20)
id 19m9oi-0004V7-D7
for asieltie@krimson.lazernet.be; Mon, 11 Aug 2003 12:22:20 +0200
From: Mail Delivery System <Mailer-Daemon@krimson.lazernet.be>
To: asieltie@krimson.lazernet.be
Subject: Warning: message 19kz9E-0007rq-8c delayed 72 hours
Message-Id: <E19m9oi-0004V7-D7@krimson.lazernet.be>
Date: Mon, 11 Aug 2003 12:22:20 +0200
This message was created automatically by mail delivery software.
A message that you sent has not yet been delivered to one or more of its
recipients after more than 72 hours on the queue on krimson.lazernet.be.
The message identifier is: 19kz9E-0007rq-8c
The subject of the message is:
http://www.dierenasieltienen.be/cgi-sys/formmail.pl (200.251.234.160:80)
bcc: cac719@aol.comW IDJZTp x P3p1 7 pc qKjOSKjKp9 a DGeqJPgh0 ecW Q
sG O Vf1G 7mtNXRt brip GS umI qllMi Bd Pt �FFFFCCabcdefghij.
The date of the message is: Fri, 08 Aug 2003 06:46:40 +0200
The address to which the message has not yet been delivered is:
xriuiUo8U@www.dierenasieltienen.be
Delay reason: lowest numbered MX record points to local host
No action is required on your part. Delivery attempts will continue for
some time, and this warning may be repeated at intervals if the message
remains undelivered. Eventually the mail delivery software will give up,
and when that happens, the message will be returned to you.
----------------------------------------------------
----------------------------------------------------
----------------------------------------------------
----- deze soort komt zes keer op 10 minuten--------
From - Tue Aug 12 13:38:56 2003
X-UIDL: 0060205c320bf101085e99a9e2967c9d
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path: <>
Envelope-to: asieltie@krimson.lazernet.be
Delivery-date: Tue, 12 Aug 2003 13:33:56 +0200
Received: from mailnull by krimson.lazernet.be with local (Exim 4.20)
id 19mXPY-00074z-Jz
for asieltie@krimson.lazernet.be; Tue, 12 Aug 2003 13:33:56 +0200
X-Failed-Recipients: xriuiUo8U@www.dierenasieltienen.be
From: Mail Delivery System <Mailer-Daemon@krimson.lazernet.be>
To: asieltie@krimson.lazernet.be
Subject: Mail delivery failed: returning message to sender
Message-Id: <E19mXPY-00074z-Jz@krimson.lazernet.be>
Date: Tue, 12 Aug 2003 13:33:56 +0200
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
xriuiUo8U@www.dierenasieltienen.be
lowest numbered MX record points to local host:
retry timeout exceeded
------ This is a copy of the message, including all the headers. ------
Return-path: <asieltie@krimson.lazernet.be>
Received: from asieltie by krimson.lazernet.be with local (Exim 4.20)
id 19kz9E-0007rq-8c
for xriuiUo8U@www.dierenasieltienen.be; Fri, 08 Aug 2003 06:46:40 +0200
To: xriuiUo8U@www.dierenasieltienen.be
From: xriuiUo8U@www.dierenasieltienen.be
Subject: http://www.dierenasieltienen.be/cgi-sys/formmail.pl
(200.251.234.160:80) bcc: cac719@aol.comW IDJZTp x P3p1 7 pc qKjOSKjKp9
a DGeqJPgh0 ecW Q sG O Vf1G 7mtNXRt brip GS umI qllMi Bd Pt
�FFFFCCabcdefghij.
Message-Id: <E19kz9E-0007rq-8c@krimson.lazernet.be>
Date: Fri, 08 Aug 2003 06:46:40 +0200
body: W IDJZTp x P3p1 7 pc qKjOSKjKp9 a DGeqJPgh0 e
cW Q sG O Vf1G 7mtNXRt brip GS umI qllMi Bd
Pt �FFFFCCabcdefghij
----------------------------------------------------
----------------------------------------------------
--
Geef verstoten honden een thuis
http://www.dierenasieltienen.be
--
Wij gebruiken linux!
http://www.linux.org
Technical Details
Message-ID:
<3f38da54$0$323$ba620e4c@reader1.news.skynet.be>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-xit-08!supernews.com!news-out.visi.com!petbe.visi.com!skynet.be!skynet.be!louie!tlk!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII X-Google-Thread: 113446,d745106449830af,start X-Google-Attributes: gid113446,public X-Google-ArrivalTime: 2003-08-12 05:15:47 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-xit-08!supernews.com!news-out.visi.com!petbe.visi.com!skynet.be!skynet.be!louie!tlk!not-for-mail Date: Tue, 12 Aug 2003 14:14:12 +0200 From: Paul Cobbaut <pol@cobbbbbaut.be> User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20030225 X-Accept-Language: en-us, en MIME-Version: 1.0 Newsgroups: be.comp.security Subject: formmail.cgi hacker ? Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Lines: 118 Message-ID: <3f38da54$0$323$ba620e4c@reader1.news.skynet.be> Organization: -= Belgacom Usenet Service =- NNTP-Posting-Host: 217.136.104.208 X-Trace: 1060690516 reader1.news.skynet.be 323 217.136.104.208:60090 X-Complaints-To: usenet-abuse@skynet.be