2

Whilst scanning my own network, I recently came across what seems like a rogue device. After running an nmap scan on it I found out it has four 'strange' ports open.

  • 4096 (HTTP server)
  • 13000 (Unknown, doesn't return any data, even when fuzzing)
  • 34000 (Unknown, same here)
  • 37858 (HTTP server, seems to be the same instance of 4096)

The ports 4096 and 37858 are HTTP servers, however they don't expose any information about what they are and what they do as all 'common' pages such as /, /admin, /home etc don't seems to return anything. Curl request (both 37858 and 4096 return the exact same):

$ curl -vvv 192.168.2.16:37858/admin
*   Trying 192.168.2.16...
* TCP_NODELAY set
* Connected to 192.168.2.16 (192.168.2.16) port 37858 (#0)
> GET /admin HTTP/1.1
> Host: 192.168.2.16:37858
> User-Agent: curl/7.51.0
> Accept: */*
> 
< HTTP/1.1 404 Not Found
< Content-Type: text/plain
< Content-Length: 30
< Connection: keep-alive
< 
Error 404: Not Found

Does anyone know what this device could be? The only thing I've been able to find so far is that the Senna Spy trojan uses port 13000, which doesn't inspire confidence.

6
  • I'm not sure we can determine anything from a list of ports alone.
    – schroeder
    Apr 22, 2017 at 19:08
  • 4
    This could be anything. Look up the first few bytes of the MAC address and see who the hardware manufacturer supposedly is. It's a start...
    – Ivan
    Apr 22, 2017 at 19:17
  • 3
    What is the environment in question here (home, office...?) and what makes you think it is a rogue device? A lot of connected gadgets like streaming devices, printers, etc. have random-seeming ports open so make sure you've eliminated those as possibilities.
    – tlng05
    Apr 22, 2017 at 19:20
  • 1
    Can you run an nmap scan with the -sV option to try to grab some versions? nmap -sV -A 192.168.2.16.
    – DKNUCKLES
    Apr 23, 2017 at 2:25
  • 2
    You need to find MAC address and check it online to see what vendor it is.
    – Aria
    Apr 23, 2017 at 17:01

1 Answer 1

3

To find out if the device's purpose, you need to know more information than just the open ports.

  • Get the Service Version info with nmap

    • nmap -sV -p 4096 192.168.2.16
  • Look up the MAC address if it is on your local network

    • Each MAC address has an OUI which tells you the manufacturer. It can be faked, but is not commonly. This will tell you if it is an Apple device, Cisco, or other. Here is an OUI tool to look up MAC addresses.
  • Perform an OS scan.
    • nmap -O 192.168.2.16
    • (fuzzy detection) nmap --osscan-guess; --fuzzy 192.168.2.16
    • This looks at how the server responds to a variety of TCP and UDP packets, looking for how different TCP/IP stacks deal with it.

Broadly speaking, if there is a server that you don't know what is there, and is listening on weird ports like that, you have a good reason to be concerned and investigate it further.

1
  • 2
    But there's a fair chance it will turn out to be a harmless gadget - perhaps a bit of network equipment with a remote admin facility.
    – Simon B
    Apr 24, 2017 at 16:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .