I am trying to get access to one of the machines in my lab. it has 2 tcp ports that I am highly suspecting which are:
- port 25 tcp
- port 111 tcp
For port 25, it is supposed to be running SMTP, however, I think that it is running another service other than SMTP since nmap and Metasploit auxiliary smtp scanner were not able to identify the SMTP service version. I tried also connecting manually using
nc -nvv x.x.x.x 25 but got nothing, not even a single response or word !
For port 111 it was identified as
111/tcp open rpcbind | rpcinfo: | 100000 2-4 111/udp rpcbind | 100024 1 57299/udp status | 100000 2-4 111/tcp rpcbind |_ 100024 1 46912/tcp status
I searched for public exploits for rpcbind and found nothing other than "DOS" exploit.Also tried the following command to see a clearer picture but nothing comes back !
attacker:~# rpcinfo -p x.x.x.x program vers proto port 100000 4 tcp 111 portmapper 100000 3 tcp 111 portmapper 100000 2 tcp 111 portmapper 100000 4 udp 111 portmapper 100000 3 udp 111 portmapper 100000 2 udp 111 portmapper 100024 1 udp 57299 status 100024 1 tcp 46912 status
Any thoughts how to find a way in ? or a way to identify a service that is running on a non standard port like port 25 here?