Let's assume that my public IP address is A.B.C.D and I have a Linux server within my network that has the IP X.Y.Z.T and I have some port open in the X.Y.Z.T server but that same port is closed in my main router so that A.B.C.D:PORT can not be reached from an outside network.

The thing is that I have been attacked by someone that exploited my resource at X.Y.Z.T:PORT by accessing it through (according to my server's logs) A.B.C.D:PORT

Logically A.B.C.D:PORT cold not be accessed from outside my network since the port is closed and the attacker's IP has no NAT address inside my network. So my question is how can something like this happen ?

Please understand that I don't expect a full answer to that, I just need some clues where to start looking (I'm a complete beginner in networks).

  • 1
    It will be very useful if you post the server log itself (the relevant part, that is, taking care to take out sensitive data). I highly doubt it says A.B.C.B:PORT (although I can think of an edge case where this is possible) since a router has two NICs, one on each side of the NAT. It may also be very useful to use 255.x.x.x as the public net and 192.168.x.x as the private one (even that it is not necessarily the actual range). People are used to think of these numbers in terms of public and private nets.
    – grochmal
    Oct 17 '16 at 22:33
  • I suggest you to ask this kind of question of network behaviour analysis on networkengineering.stackexchange.com .
    – dan
    Oct 22 '16 at 15:29
  • As @8zero2 has mentioned, it is very much possible that malicious program from the server has initiated the connection and this leads to the exploitation of your resources. Oct 22 '16 at 16:14

Simple answer: Start sniffing your network and discover what is happening. After this work with what you'd seen.

Sources, destinations, packets entering, packets leaving and possibly their content. It's all there if you can catch.

Sniffing your network and understanding how this connection is being stablished without suppositions is the key to solve your problem, so you can start working on what's really happening.

Discover how it's leaving your network and drop it.

  • Very true. I recomend also ARPing or somehow using the router to cap packets just to make sure you cap them all.
    – dGRAMOP
    Oct 18 '16 at 2:08
  • I did that, but it was too late
    – Fourat
    Oct 24 '16 at 19:45

actually as you said none from outside can establish connection from outside to port on router

x.y.z.t <-----------------------a.b.c.d:port  |  <-----cannot access

but we cannot deny the possiblily of reverse TCP by any of the known [reverse shell via ssh , php shell , meterpetor ] or unknown method

x.y.z.t <===================> a.b.c.d:port<============> 

like some malicious program initaited as remote port forwarding ssh shell tunnel it got nated ny the port you mentioned on router and logged on to the attacker shell , from there now you are vulnerbale to be attacked by remote attacker via that NATTED port

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.