I've got a LTE wifi router(JioFi 2) and there's port 6666 and 7777 are open.

Nmap scan result,

53/tcp   open  domain
80/tcp   open  http
6666/tcp open  irc
7777/tcp open  cbt

I can understabnd why port 53 and 80 are open, but why 6666 and 7777 ? What they're doing there ?

The device is made by Haier, which is accused many times of shipping devices with preinstalled malwares.

So my main question is how can I go deeper into this issue ?

  • It'd seem strange if a router with malware would choose to report the ports that the malware uses. – Nat May 5 '17 at 19:05
  • 1
    Are you able to remote into the router some how and figure out what processes the ports are bound to? That could give you a better idea. – Dan Landberg May 5 '17 at 19:11
  • Try telnetting to these ports. – davidbaumann May 5 '17 at 19:27
  • @user52472 , no I cant login there any how except the web GUI, though I don't know if there's a serial console in the device. I cant tear it down, warranty issue. – Arnab May 6 '17 at 1:17
  • @davidbaumann , sorry telnet is not responding. – Arnab May 6 '17 at 1:17

In most situations, I would recommend trying to remote into the system, and see if you can see what processes are listening on those ports. That would give you the best idea of what is going on in the system (i.e. which processes are bound to those ports).

Since that does not appear to be an option for you, my next suggestion would be to monitor all traffic which is going into those ports using Wireshark or a similar protocol analyzer. You might be able to determine what those ports are doing based on the traffic going to them, and may even be able to capture some login credentials.

Given the fact that this is an LTE router, and you may not be able to perform a capture on those ports, my last suggestion would be to see if you can download a copy of the router's firmware from the internet. You can then analyze the firmware with a tool like binwalk. This is not a very reliable method, since there is no guarantee that the firmware on your router will match what was downloaded, but if you can't find those ports open on the downloaded image, you know something is odd about the firmware running on your router.

|improve this answer|||||
  • A very useful answer, but perhaps wireshark will not be able to capture anything. The binwalk method is quite interesting, I'll try it if I can grab a copy of the firmware. – Arnab May 9 '17 at 4:59

Port 7777/tcp can be used by: iChat server file transfer proxy or Oracle Cluster File System 2 or even games (Ultima Online, Active Worlds).

Same for 6666 - this one is often used for relay chat, but can indeed be used by a lot of malware too.

So it's not the port itself that is the problem (or it's current state). You must analyze the traffic on that port when the device is in normal functionality mode in order to determine if there is something bad sent through there.

|improve this answer|||||
  • yeah, I've to analyze the traffic after discovering a viable way to get a shell, may be serial port. – Arnab May 19 '17 at 1:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.