I am running tests on a server that is ran by a close family friend, who agreed to allow me to do so in exchange for the experience I will gather (I am currently a computer science student).
On scanning one of his servers, I discovered an odd open port (3030) that had an odd output I've never seen before. I did as much research as possible on the internet (supposedly, the service is called arepa-cas), but I couldn't find explanation for the output of my netcat. I also discovered it was a relatively well known port for certain viruses to communicate on, and I immediately recognized in the output some sort of encoding, and was wondering if I should be looking further into this. Here is sample output from a nc bind to the host & port:
root@localhost:~/[struck]# netcat -v -v [struck] 3030 DNS fwd/rev mismatch: [struck] != [struck] [struck] [struck] 3030 (?) open Aoe3Nc34iOc09HezzugEtiyLqqbUrR6ne57cfd6b7cd349bc8e08a5b83bdf5ee4>help aX6JWsHFW47DOv7hOrdwSMgJMYVXYoGBwvJjE+c516rUW6bFP7DVBmgRWkLPHGTM>? 3r9DrxDy/kWdMA5VjtxnrA==>ls 3r9DrxDy/kWdMA5VjtxnrA==>^C sent 10, rcvd 180
I am not really asking for much other than where to begin, first of all trying to decode these messages (I tried base64 decoding, among others, as a wild guess, but yielded nothing. These look SUPER similar to JWT's, but then again, what encoded data doesn't), finding out what their context is, etc. Any nudging in the right direction would be super appreciated!