1

I am running tests on a server that is ran by a close family friend, who agreed to allow me to do so in exchange for the experience I will gather (I am currently a computer science student).

On scanning one of his servers, I discovered an odd open port (3030) that had an odd output I've never seen before. I did as much research as possible on the internet (supposedly, the service is called arepa-cas), but I couldn't find explanation for the output of my netcat. I also discovered it was a relatively well known port for certain viruses to communicate on, and I immediately recognized in the output some sort of encoding, and was wondering if I should be looking further into this. Here is sample output from a nc bind to the host & port:

root@localhost:~/[struck]# netcat -v -v [struck] 3030
DNS fwd/rev mismatch: [struck] != [struck]
[struck] [struck] 3030 (?) open
Aoe3Nc34iOc09HezzugEtiyLqqbUrR6ne57cfd6b7cd349bc8e08a5b83bdf5ee4>help
aX6JWsHFW47DOv7hOrdwSMgJMYVXYoGBwvJjE+c516rUW6bFP7DVBmgRWkLPHGTM>?
3r9DrxDy/kWdMA5VjtxnrA==>ls
3r9DrxDy/kWdMA5VjtxnrA==>^C sent 10, rcvd 180

I am not really asking for much other than where to begin, first of all trying to decode these messages (I tried base64 decoding, among others, as a wild guess, but yielded nothing. These look SUPER similar to JWT's, but then again, what encoded data doesn't), finding out what their context is, etc. Any nudging in the right direction would be super appreciated!

  • 1
    Welcome to Information Security! Could you clarify what exactly you are looking for? I assume you want to know how to determine what this service is, but I don't see that stated explicitly. Are you only allowed to do external scans or can you get shell access into the host? – amccormack Jun 4 '15 at 18:00
4

Determining What Is Running

Locally, Ask The Host

The most definitive way to determine what is communicating on port 3030 is to ssh into the server and run netstat.

netstat -nap | grep 3030

Will display connections and listening processes -n skips DNS resolution of IP addresses, -a shows the state of all sockets, and -p shows the PID of the process bound to that socket.

If you are using windows, check out this SO post.

Determining Remotely

If you can't get access to the server, there are other things you can try.

Run nmap against the port. nmap has pretty good service detection and if what is running on 3030 is a well known protocol, nmap will likely determine it.

nmap -sV host

You can find out more about nmap service detection in Chapter 7 of the nmap book.

What if nmap can't determine the service?

It may be that you are looking at a legitimate custom service for that application. Though you could also be looking at malware.

Determining the functionality of the service

If have permission to interact with the service, here are a few things you could try/notice:

  • It appears that each response is base64 encoded, and ends with a >. This to me suggests that it is a shell of some kind. Base64 decoding gives garbage, which suggests that this could be encrypted, although it could also be a custom base64 alphabet.
  • Enter various text. Does the same output get produced for the same input?
  • Is there a correlation between input length and output length?
  • Is output length always a multiple of some number? For example, in the four lines you showed in the question, the lines decoded to 48,48,16 and 16 bytes long. This could suggest a block cipher of some kind is being used.
  • Does the initial response to your connection change each time you make the connection? This could suggest the server is using a one time encryption key (or base64 encoding) for each connection. Thus, the first response likely contains the information necessary to interact with the service.
  • If you start to get common strings, start googling them. If you get a hit, you may get your answer.
  • Note, if custom encoding or encryption is being used, it is unlikely that your input will do anything, as the input will probably need to match the same encoding scheme.
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.