Can I elicit responses from "any remote host" on "all protocols" if I want to?

Question

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited.

It is explained here that:

By default, WSDAPI will listen on TCP ports 5357 and 5358. The Windows Firewall will allow messages in to these ports if the interface firewall profile is anything other than Public. This means under non-Public profiles (e.g. Private or Domain) the vulnerability can be reached by remote, unauthenticated users.

For an attacker to be able to trigger the vulnerability on a target, they need to know the WSD Address value for the target, which is a UUID (Universally Unique Identifier). This value is automatically sent in broadcast UDP messages to port 3702 (WS-Discovery) in an effort to discover devices that support WSD. Being broadcast UDP the message will only be visible to attackers on the same subnet. Attackers on other subnets, or on the Internet, will not be able to launch attacks against distant targets using this approach.

A system could also be exploited by a malicious device which responds to a client computer using WSDAPI. It is possible for the user to manually enter the URL of a device to connect to, in which case the device could respond with a malformed message and trigger the vulnerability. This requires user-interaction and social engineering, however.

This makes me think.

Since I am fairly new to this field and struggling with this, my question now is whether I should and can generally elicit, in this case, an UDP packet response from a “remote host” to get this information and how can I do that? Or that something like this happens automatically and that the “remote host” in question does this on its own?

In addition, I would like to know whether it is possible for other protocols to elicit responses from any random device, whether it is connected to a network or not.

Answer 1

I will start by answering your last question first.

What you asked is, “is it possible for protocols (agreed upon methods of communication) to elicit a response from any random device, wether it is connected to a network OR NOT.”

How would two devices, one that is connected to a network, and one that is not (one that is essentially air gapped), pass traffic to each other?

In order for any two parties to communicate, there must be some method for data to pass from source to destination and back. If you are in Hong Kong, and I am in Alberta, and I think, gee, I hope Freddy Nova hears my thoughts.... You see what I am saying. There needs to be a path of communication to follow, we don’t use magic.

Perhaps you meant to ask if there are methods for exfiltrating the data you are asking for while not being on the same network? The data you provided said there is. What is that method?

That is outside the scope of a question answer site like this. It depends on what type of systems are inside the network, what systems you have access to, what apps on those systems you have access to, what you are allowed to do. You’re asking for someone to provide you an exploit (without enough data to do so).

This is the subject of a class, not a question. If you want to learn how to do these things, or figure them out, I’d recommend hack the box. You can learn how to exploit things like this yourself.