Hi all,
Mandrake 7.2 runing:
Apache ( 1.3.14 )
Bind ( 8.2.3 )
I just did a routine port scan and found port 31137 open .. I killed all
non-essential programs and the port was closed.
I suspect a rootkit (?) ... need help ..
-James
by -Anonymous » Sat, 28 Apr 2001 05:00:18
Mandrake 7.2 runing:
Apache ( 1.3.14 )
Bind ( 8.2.3 )
I just did a routine port scan and found port 31137 open .. I killed all
non-essential programs and the port was closed.
I suspect a rootkit (?) ... need help ..
-James
by Jan Van der Veke » Sat, 28 Apr 2001 05:17:48
> Mandrake 7.2 runing:
> Apache ( 1.3.14 )
> Bind ( 8.2.3 )
> I just did a routine port scan and found port 31137 open .. I killed all
> non-essential programs and the port was closed. I suspect a rootkit (?)
> ... need help ..
This should give you the name of the process that
listens on the port. Check if it is something familiar.
If this reveals nothing, but the portscan does ...
something fishy is going on and you may have been rooted.
Jan Van der Veken
by -Anonymous » Sat, 28 Apr 2001 05:59:52
Just to be sure, I'm actually doing a fresh install on a new box so that I
can "swap" the machines and test the (possibly) comprpmised box offline.
-James
> > Hi all,
> > Mandrake 7.2 runing:
> > Apache ( 1.3.14 )
> > Bind ( 8.2.3 )
> > I just did a routine port scan and found port 31137 open .. I killed all
> > non-essential programs and the port was closed. I suspect a rootkit (?)
> > ... need help ..
> lsof -i tcp:31137
> This should give you the name of the process that
> listens on the port. Check if it is something familiar.
> If this reveals nothing, but the portscan does ...
> something fishy is going on and you may have been rooted.
> Jan Van der Veken
by Luke Voge » Sat, 28 Apr 2001 06:18:16
> Thanks for the prompt reply !!
> Just to be sure, I'm actually doing a fresh install on a new box so that I
> can "swap" the machines and test the (possibly) comprpmised box offline.
> -James
> > > Hi all,
> > > Mandrake 7.2 runing:
> > > Apache ( 1.3.14 )
> > > Bind ( 8.2.3 )
> > > I just did a routine port scan and found port 31137 open .. I killed all
> > > non-essential programs and the port was closed. I suspect a rootkit (?)
> > > ... need help ..
Sir, you seem to be in a league of your own when it comes to commonsense
practice. Well done. Please feel free to ask all the questions you
like.
--
Regards
Luke
------
But it does move!
-- Galileo Galilei
------
http://www.bell-bird.com.au
PLEASE NOTE: Spamgard (tm) installed.
------
by . » Sat, 28 Apr 2001 10:54:46
See www.chkrootkit.org and download their rootQuote:> Hi all,
> Mandrake 7.2 runing:
> Apache ( 1.3.14 )
> Bind ( 8.2.3 )
> I just did a routine port scan and found port 31137 open .. I killed all
> non-essential programs and the port was closed.
> I suspect a rootkit (?) ... need help ..
Possibly try the adore worm finder too.
http://www.ists.dartmouth.edu/IRIA/knowledge_base/tools/adorefind.htm
Unpatched versions of bind are wide open for
root compromises. See http://www.sans.org/y2k/adore.htm
When I have "net.inet.tcp.blackhole: 2" set, nmap shows the following:
31337/tcp filtered Elite
(other ports I have accessible from the outside are identd, domain (DNS)
and ssh).
Full output from outside the firewall:
(The 1598 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
53/tcp open domain
113/tcp open auth
When I set the value to "0", this doesn't show up. I haven't seen any
evidence that I have been h4x0r3d, but this is a little unsettling... is
this a sort-of-funny joke in FreeBSD (or nmap), or should I be
concerned? I cannot see this port in netstat output (even if I copy the
netstat binary from another fbsd 4.8 machine), nor can I connect to it
from localhost or from outside. I do not, however, see this behavior
with another 4.8 box.
FreeBSD 4.8; nmap v 3.00.
--
No copies, please.
To reply privately, simply reply; don't remove anything.
2. <*****ZIP DRIVE INFO PLEASE ?******>
4. : How to profile X-appl. without profiled X-libs
5. Funny story about port 31337...
6. acessing floppies or cdrom!!!
7. Chkrootkit--bindshell INFECTED (ports: 31337)
9. Port 31337
11. Need help porting DOS app that uses parallel port
12. Need help porting DOS app that uses parallel port (Part II)
13. *** Port Mapping (or Port Forwarding), need help fast PLEASE ***