An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi” After some research, this is something that can be exploited.

https://msrc-blog.microsoft.com/2009/11/10/vulnerability-in-web-services-on-devices-wsd-api/

It is explained here that:

By default, WSDAPI will listen on TCP ports 5357 and 5358. The Windows Firewall will allow messages in to these ports if the interface firewall profile is anything other than Public. This means under non-Public profiles (e.g. Private or Domain) the vulnerability can be reached by remote, unauthenticated users.

For an attacker to be able to trigger the vulnerability on a target, they need to know the WSD Address value for the target, which is a UUID (Universally Unique Identifier). This value is automatically sent in broadcast UDP messages to port 3702 (WS-Discovery) in an effort to discover devices that support WSD. Being broadcast UDP the message will only be visible to attackers on the same subnet. Attackers on other subnets, or on the Internet, will not be able to launch attacks against distant targets using this approach.

A system could also be exploited by a malicious device which responds to a client computer using WSDAPI. It is possible for the user to manually enter the URL of a device to connect to, in which case the device could respond with a malformed message and trigger the vulnerability. This requires user-interaction and social engineering, however. This makes me think.

Since I am fairly new to this field and struggling with this, my question now is whether I should and can generally elicit a, in this case, an UPD packet response from a “remote host” to get this information and how I can That do? Or that something like this happens automatically and that the “remote host” in question does this on its own?

In addition, I would like to know whether it is possible for other protocols to elicit responses from any random device that, whether or not, is connected to a network.

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited.

It is explained here that:

By default, WSDAPI will listen on TCP ports 5357 and 5358. The Windows Firewall will allow messages in to these ports if the interface firewall profile is anything other than Public. This means under non-Public profiles (e.g. Private or Domain) the vulnerability can be reached by remote, unauthenticated users.

For an attacker to be able to trigger the vulnerability on a target, they need to know the WSD Address value for the target, which is a UUID (Universally Unique Identifier). This value is automatically sent in broadcast UDP messages to port 3702 (WS-Discovery) in an effort to discover devices that support WSD. Being broadcast UDP the message will only be visible to attackers on the same subnet. Attackers on other subnets, or on the Internet, will not be able to launch attacks against distant targets using this approach.

A system could also be exploited by a malicious device which responds to a client computer using WSDAPI. It is possible for the user to manually enter the URL of a device to connect to, in which case the device could respond with a malformed message and trigger the vulnerability. This requires user-interaction and social engineering, however.

This makes me think.

Since I am fairly new to this field and struggling with this, my question now is whether I should and can generally elicit, in this case, an UDP packet response from a “remote host” to get this information and how can I do that? Or that something like this happens automatically and that the “remote host” in question does this on its own?

In addition, I would like to know whether it is possible for other protocols to elicit responses from any random device, whether it is connected to a network or not.