2

Whilst scanning my own network, I recently came across what seems like a rogue device. After running an nmap scan on it I found out it has four 'strange' ports open.

  • 4096 (HTTP server)
  • 13000 (Unknown, doesn't return any data, even when fuzzing)
  • 34000 (Unknown, same here)
  • 37858 (HTTP server, seems to be the same instance of 4096)

The ports 4096 and 37858 are HTTP servers, however they don't expose any information about what they are and what they do as all 'common' pages such as /, /admin, /home etc don't seems to return anything. Curl request (both 37858 and 4096 return the exact same):

$ curl -vvv 192.168.2.16:37858/admin
*   Trying 192.168.2.16...
* TCP_NODELAY set
* Connected to 192.168.2.16 (192.168.2.16) port 37858 (#0)
> GET /admin HTTP/1.1
> Host: 192.168.2.16:37858
> User-Agent: curl/7.51.0
> Accept: */*
> 
< HTTP/1.1 404 Not Found
< Content-Type: text/plain
< Content-Length: 30
< Connection: keep-alive
< 
Error 404: Not Found

Does anyone know what this device could be? The only thing I've been able to find so far is that the Senna Spy trojan uses port 13000, which doesn't inspire confidence.

  • I'm not sure we can determine anything from a list of ports alone. – schroeder Apr 22 '17 at 19:08
  • 4
    This could be anything. Look up the first few bytes of the MAC address and see who the hardware manufacturer supposedly is. It's a start... – Ivan Apr 22 '17 at 19:17
  • 3
    What is the environment in question here (home, office...?) and what makes you think it is a rogue device? A lot of connected gadgets like streaming devices, printers, etc. have random-seeming ports open so make sure you've eliminated those as possibilities. – tlng05 Apr 22 '17 at 19:20
  • 1
    Can you run an nmap scan with the -sV option to try to grab some versions? nmap -sV -A 192.168.2.16. – DKNUCKLES Apr 23 '17 at 2:25
  • 2
    You need to find MAC address and check it online to see what vendor it is. – Aria Apr 23 '17 at 17:01
3

To find out if the device's purpose, you need to know more information than just the open ports.

  • Get the Service Version info with nmap

    • nmap -sV -p 4096 192.168.2.16
  • Look up the MAC address if it is on your local network

    • Each MAC address has an OUI which tells you the manufacturer. It can be faked, but is not commonly. This will tell you if it is an Apple device, Cisco, or other. Here is an OUI tool to look up MAC addresses.
  • Perform an OS scan.
    • nmap -O 192.168.2.16
    • (fuzzy detection) nmap --osscan-guess; --fuzzy 192.168.2.16
    • This looks at how the server responds to a variety of TCP and UDP packets, looking for how different TCP/IP stacks deal with it.

Broadly speaking, if there is a server that you don't know what is there, and is listening on weird ports like that, you have a good reason to be concerned and investigate it further.

  • 2
    But there's a fair chance it will turn out to be a harmless gadget - perhaps a bit of network equipment with a remote admin facility. – Simon B Apr 24 '17 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.