Full Disclosure mailing list archives
Re: .NET REMOTING on port 31337
From: Simon Smith <simon () snosoft com>
Date: Fri, 28 Sep 2007 14:42:51 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Unfortunately I do not have the control or authority to dig into it further... but your input has been helpful... Fabrizio wrote:
If you think it's that critical, (i think it's that critical) start by blocking any connections from anywhere to that machine/port. See if anyone complains. Check any old firewall logs for that port while you're at it. Then continue your investigation!! Fabrizio On 9/28/07, *Simon Smith* <simon () snosoft com <mailto:simon () snosoft com>> wrote: Got output... and it was... no idea what it was... can't paste it due to confidentiality though. Fabrizio wrote:.NET Remoting is "a generic system for different applications touse tocommunicate with one another." It's part of the .NET framework, obviously. (not trying to be a smart ass)I'm gonna take a wild guess and say it's not a good thing......Connect to it, and see if you get any output, if you haven't already done so.FabrizioOn 9/28/07, * Simon Smith* < simon () snosoft com<mailto:simon () snosoft com><mailto:simon () snosoft com <mailto:simon () snosoft com>>> wrote:Has anyone ever heard of .NET REMOTING running on port 31337? If so, have you ever seen it "legitimate"?_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html <http://lists.grok.org.uk/full-disclosure-charter.html> <http://lists.grok.org.uk/full-disclosure-charter.html> Hosted and sponsored by Secunia - http://secunia.com/ <http://secunia.com/> ------------------------------------------------------------------------_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
------------------------------------------------------------------------
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
- -- - - simon - ---------------------- http://www.snosoft.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) iD8DBQFG/Usqf3Elv1PhzXgRAh5AAJ0RxE4tIngEn8UEEI4zAcegyrwpWgCfV/So VujlHHNApdBkb4oyl9n698I= =Xp4i -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: New term "RDV" is born, (continued)
- Re: New term "RDV" is born Valdis . Kletnieks (Sep 28)
- Re: New term "RDV" is born Simon Smith (Sep 28)
- .NET REMOTING on port 31337 Simon Smith (Sep 28)
- Re: .NET REMOTING on port 31337 The Security Community (Sep 28)
- Re: .NET REMOTING on port 31337 Simon Smith (Sep 28)
- Re: .NET REMOTING on port 31337 Fabrizio (Sep 28)
- Re: .NET REMOTING on port 31337 Joel R. Helgeson (Sep 28)
- Re: .NET REMOTING on port 31337 Fabrizio (Sep 28)
- Re: .NET REMOTING on port 31337 Simon Smith (Sep 28)
- Re: .NET REMOTING on port 31337 Fabrizio (Sep 28)
- Re: .NET REMOTING on port 31337 Simon Smith (Sep 28)
- Re: .NET REMOTING on port 31337 Joel R. Helgeson (Sep 28)
- Re: .NET REMOTING on port 31337 Fabrizio (Sep 28)
- Message not available
- Re: .NET REMOTING on port 31337 Joel R. Helgeson (Sep 30)
- Re: New term "RDV" is born Jimby Sharp (Sep 28)
- Re: New term "RDV" is born J. Oquendo (Sep 28)
- Re: New term "RDV" is born nocfed (Sep 28)
- Re: New term "RDV" is born worried security (Sep 28)
- Re: New term "RDV" is born Kevin Finisterre (lists) (Sep 28)
- Re: New term "RDV" is born Guasconi Vincent (Sep 30)
- Re: New term "RDV" is born Jimby Sharp (Sep 30)