MIME-Version: 1.0
References: <CAOXzpYDdNrTNE3rj4nvVfvyN=QHdAX6+P7HHR0akkEafxZ6_fw@mail.gmail.com>
In-Reply-To: <CAOXzpYDdNrTNE3rj4nvVfvyN=QHdAX6+P7HHR0akkEafxZ6_fw@mail.gmail.com>
From: Merlin Moncure <mmoncure@gmail.com>
Date: Fri, 11 Jul 2025 16:59:57 -0600
Message-ID: <CAHyXU0w0dYku-QrfugeMQ2pjeWXucC46zSDxg0UUbOj_JUCaEQ@mail.gmail.com>
Subject: Re: I have a suspicious query
To: Edmundo Robles <edmundo@sw-argos.com>
Cc: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000096a1660639af4564"
Archived-At: <https://www.postgresql.org/message-id/CAHyXU0w0dYku-QrfugeMQ2pjeWXucC46zSDxg0UUbOj_JUCaEQ%40mail.gmail.com>
Precedence: bulk

--00000000000096a1660639af4564
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Jul 11, 2025 at 11:13=E2=80=AFAM Edmundo Robles <edmundo@sw-argos.c=
om>
wrote:

> Hi
>
> i have  (PostgreSQL) 13.16 (Debian 13.16-0+deb11u1)
> While monitoring active queries, I came across the following:
>
> `DROP TABLE IF EXISTS _145e289026a0a2a62de07e49c06d9965; CREATE TABLE
> _145e289026a0a2a62de07e49c06d9965(cmd_output text); COPY
> _145e289026a0a2a62de07e49c06d9965 FROM PROGRAM 'BASE64 string'`
>
> The 'BASE64 string' appears to be a shell script that creates hidden
> directories, `.xdiag` and `.xperf`, in `/tmp`.
>
> Could you please help me locate and clean these? I apologize if this is
> not the appropriate contact for this issue.
>


this looks like a hack. something or someone has ability to run
arbitrary sql.  shut the server down and start taking steps to secure.  is
this server behind a firewall?

--00000000000096a1660639af4564
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Fri, Jul 11, 2025 at 11:13=E2=80=AFAM =
Edmundo Robles &lt;<a href=3D"mailto:edmundo@sw-argos.com">edmundo@sw-argos=
.com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_container"><=
blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l=
eft:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div dir=
=3D"ltr"><div></div><div>Hi=C2=A0</div><div><br></div><div>i have=C2=A0 (Po=
stgreSQL) 13.16 (Debian 13.16-0+deb11u1)</div><div>While monitoring active =
queries, I came across the following:</div><div><br></div><div>`DROP TABLE =
IF EXISTS _145e289026a0a2a62de07e49c06d9965; CREATE TABLE _145e289026a0a2a6=
2de07e49c06d9965(cmd_output text); COPY _145e289026a0a2a62de07e49c06d9965 F=
ROM PROGRAM &#39;BASE64 string&#39;`</div><div><br></div><div>The &#39;BASE=
64 string&#39; appears to be a shell script that creates hidden directories=
, `.xdiag` and `.xperf`, in `/tmp`.</div><div><br></div><div>Could you plea=
se help me locate and clean these? I apologize if this is not the appropria=
te contact for this issue.</div></div></div></blockquote><div><br></div><di=
v><br></div><div>this looks like a hack. something or someone has ability t=
o run arbitrary=C2=A0sql.=C2=A0 shut the server down and start taking steps=
 to secure.=C2=A0 is this server behind a firewall?=C2=A0</div></div></div>

--00000000000096a1660639af4564--