Whilst scanning my own network, I recently came across what seems like a rogue device. After running an nmap scan on it I found out it has four 'strange' ports open.
- 4096 (HTTP server)
- 13000 (Unknown, doesn't return any data, even when fuzzing)
- 34000 (Unknown, same here)
- 37858 (HTTP server, seems to be the same instance of 4096)
The ports 4096 and 37858 are HTTP servers, however they don't expose any information about what they are and what they do as all 'common' pages such as
/home etc don't seems to return anything. Curl request (both 37858 and 4096 return the exact same):
$ curl -vvv 192.168.2.16:37858/admin * Trying 192.168.2.16... * TCP_NODELAY set * Connected to 192.168.2.16 (192.168.2.16) port 37858 (#0) > GET /admin HTTP/1.1 > Host: 192.168.2.16:37858 > User-Agent: curl/7.51.0 > Accept: */* > < HTTP/1.1 404 Not Found < Content-Type: text/plain < Content-Length: 30 < Connection: keep-alive < Error 404: Not Found
Does anyone know what this device could be? The only thing I've been able to find so far is that the Senna Spy trojan uses port 13000, which doesn't inspire confidence.