RE: How to find process behing TCP connection ?

["Simon Zuckerbraun" <szucker () sst-pr-1 com>]

An up-to-date version of ProcessExplorer will let you view the TCP and UDP
endpoints associated with a process, and then view a snapshot of the call
stack that existed at the time that the process opened the endpoint. You can
double-click on the endpoint to view the call stack. This technique can
potentially yield great clues. The ProcessExplorer help file in fact
mentions this explicitly as a technique for analyzing activity in the System
process:

"This is useful for identifying the purpose of endpoints in the System
process and Svchost processes because the stack will include the name of the
driver or service that is responsible for the endpoint."

(I am not an expert on forensics. But if I were in this situation I would
definitely consider yanking the hard drive and making a copy to analyze
off-line.)

Simon


-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Buozis, Martynas
Sent: Wednesday, September 27, 2006 3:12 PM
To: Colin Copley
Cc: security-basics () securityfocus com
Subject: RE: How to find process behing TCP connection ?


Sorry, but I probably was not clear in my explanation. Problem is that
Windows 2003 server is acting as client in my case. Windows Server is
initiating session to port 139 to different workstations on the net. It
actually tries to login to many workstations on different local subnets as
user Administrator (logon is denied). I want understand which process behind
"System 4" initiates this scan to many computers with attempt to logon as
Admin user.

I can bet that there must be people who already were trying to find process
behind "System 4" and I will appreciate if somebody will share his/her
experience.

I already set up an open system and wait till it hit it's IP to understand
what will follow upon successful logon. But I expect that there must be a
way how to find under Windows what is behind connection. So easy with lsof
under Unix, looks like impossible under Windows?...

Thanks.


With best regards
Martynas 

-----Original Message-----
From: Colin Copley [mailto:colin.75 () btinternet com] 
Sent: Wednesday, September 27, 2006 8:55 PM
To: Buozis, Martynas
Cc: security-basics () securityfocus com
Subject: Re: How to find process behing TCP connection ?

Maybe this is some help?

http://forum.sysinternals.com/forum_posts.asp?TID=3432

If not, perhaps you could attempt to telnet or putty into the port, and see
if it returns an error message which might give some more info. Another idea
- try ethereal to capture the packet data and see what it contains. Also I
believe nmap can attempt to establish what's listening on a certain port.
It might give you more info than just system 4. Regards Colin

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------