1

I found a question from here: http://www.activeresponse.org/20-questions-for-an-intrusion-analyst/ But not sure what its answer is. Here is the question and it asks me to find out all suspicious entries:

Proto Local Address     Foreign Address    State
 TCP  0.0.0.0:53        0.0.0.0:0          LISTENING
 TCP  0.0.0.0:135       0.0.0.0:0          LISTENING
 TCP  0.0.0.0:445       0.0.0.0:0          LISTENING
 TCP  0.0.0.0:5357      0.0.0.0:0          LISTENING
 TCP  192.168.1.4:53    91.198.117.247:443 CLOSE_WAIT
 TCP  192.168.1.4:59393 74.125.224.39:443  ESTABLISHED
 TCP  192.168.1.4:59515 208.50.77.89:80    ESTABLISHED
 TCP  192.168.1.4:59518 69.171.227.67:443  ESTABLISHED
 TCP  192.168.1.4:59522 96.16.53.227:443   ESTABLISHED
 TCP  192.168.1.4:59523 96.16.53.227:443   ESTABLISHED
 TCP  192.168.1.4:53    208.71.44.30:80    ESTABLISHED
 TCP  192.168.1.4:59538 74.125.224.98:80   ESTABLISHED
 TCP  192.168.1.4:59539 74.125.224.98:80   ESTABLISHED

So far, I figured out the first 4 entries should be no problem. Port 53(DNS), 135(rpc), 445(SMB), 5357(some windows service) And this entry should be suspicious since DNS service connects to HTTP service

TCP  192.168.1.4:53    208.71.44.30:80    ESTABLISHED

Can anyone tell me if there is any other entry suspicious or if I miss anything important? Actually, I see there are multiple connections to the same IP address on port 80(and 443). Is it normal?

Thanks.

  • Sometimes it's best to wait a day or two before marking an answer as correct to allow other valid answers to be posted. – Neil Smithline Jan 6 '16 at 14:40
3

I would actually be suspicious of the fact it is listening on port 53, especially if it is a workstation - Why should it be running a DNS Server? It may be an indication of malicious communications attempting to disguise themselves as DNS / HTTP / HTTPS traffic given, as you mentioned, the connections from port 53 <-> 80/443.

If it were a real scenario, you may then want to poke around and see which process is listening on port 53 (By adding the "-o" option to the netstat command)

Connections to the same address on ports 80 and 443 is not necessarily unusual. For example, a website with mixed content may be serving content over both HTTP (80) and HTTPS (443).

  • 1
    Adding one more point to this, how 74.125.224.98 is listened on 80. Since it is a google IP so it should be 443. There might be a chance of MITM. – P4cK3tHuNt3R Jan 6 '16 at 17:41
1

You can use this command to list tcp ports and their associated services:

  netstat -plnt

Use u for t to list udp ports. I think your output is nornmal because tcp and udp port 53 on clients is used by dnsmasq :

tcp        0      0 192.168.122.1:53   LISTEN      10736/dnsmasq 
udp        0      0 192.168.122.1:53               10736/dnsmasq 

$man dnsmaq 
NAME
   dnsmasq - A lightweight DHCP and caching DNS server.
   ...........................
   ...........................

I think it will be the same in your case. It is installed by default.

For testing , you can either stop or purge it and see again if it appears in your output or not.

0

It is quite difficult to say by just looking at the output of netstat, it just shows the current tcp and udp connections state.

Moreover we don't know about the service you are hosting knowingly or unknowingly and whether these tcp connections are simple tcp or some reversibility is possible and opens a reverse shell to attacker.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.