pen-test
[Top] [All Lists]

Re: Strange ports

To: killy <killfactory@gmail.com>
Subject: Re: Strange ports
From: Tim Shea <tim@tshea.net>
Date: Tue, 19 Jun 2007 17:36:26 -0500
Cc: Pen-Tests <pen-test@securityfocus.com>
Delivered-to: sp-com-lists@consult.net
Delivered-to: pentest-list2@consult.net
Delivered-to: mailing list pen-test@securityfocus.com
Delivered-to: moderator for pen-test@securityfocus.com
In-reply-to: <9c43c6dd0706181159g412a60bekeaabcae80143172a@mail.gmail.com>
List-help: <mailto:pen-test-help@securityfocus.com>
List-id: <pen-test.list-id.securityfocus.com>
List-post: <mailto:pen-test@securityfocus.com>
List-subscribe: <mailto:pen-test-subscribe@securityfocus.com>
List-unsubscribe: <mailto:pen-test-unsubscribe@securityfocus.com>
Mailing-list: contact pen-test-help@securityfocus.com; run by ezmlm
References: <9c43c6dd0706181159g412a60bekeaabcae80143172a@mail.gmail.com>
Resent-date: Tue, 19 Jun 2007 16:02:53 -0600 (MDT)
Resent-from: pen-test-return-1078484405@securityfocus.com
Resent-message-id: <20070619220253.C857714450B@outgoing2.securityfocus.com>
Resent-sender: listbounce@securityfocus.com
Sender: listbounce@securityfocus.com

My first step would be to request the firewall ruleset (or grab them yourself if you have access) and trace back to the source on your internal network. Then ask the owners of whatever you traced it back to that very question.


On Jun 18, 2007, at 1:59 PM, killy wrote:

Scanning my external firewall(at work), I (yes, it is my job to) find this:


PORT     STATE    SERVICE
53/tcp   open     domain

1029/tcp open     ms-lsa
1032/tcp open     iad3

3389/tcp open     ms-term-serv


Why would 1029 and 1032 need to be open from the outside?

-Kill


--
If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- former White House cybersecurity czar Richard Clarke

---------------------------------------------------------------------- --
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
---------------------------------------------------------------------- --



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------


<Prev in Thread] Current Thread [Next in Thread>