Re: .NET REMOTING on port 31337

["Joel R. Helgeson" <joel () helgeson com>]

> Stand there and risk come confidential data being compromised!

 

Yes. Stand there. Monitor traffic. Do nothing to stop or impede. The moment
you change ANYTHING you immediately start losing evidence.

Right now there is an IF involved. If I reacted to every strange service I
found running on the manifold networks I've audited. You monitor, go to the
machine in question and investigate the service running that is servicing
that port. If it is hacked, it is up to the customer to call upon their
Emergency Response Plan.

 

I have found a service running on a Win2k3 server that the admin wanted me
to just simply clean it off. I advised against it. They agreed and I
gathered information about the intrusion (doing nothing to clean it off) and
found that it was just the tip of the iceberg, that the server had acted as
a gateway to the infection of six servers on their network, each with a
different piece of the hack and info gathering done on each server. On a
separate server, I saw where they used IPv4toIPv6 mapping tool to redirect
an IPv4 to IPv4 port mapping, so windows remote desktop admin could be
accessed using port 443. The simple removing of the initial infection would
have left the rest of the breach unnoticed.    This hack also included
setting up windows task scheduler to request updates from a list of domains,
to re-establish hacker access should we cut them off.. which we did.  They
were good, damn good.

 

-joel

 

 

 

From: Fabrizio [mailto:staticrez () gmail com] 
Sent: Friday, September 28, 2007 1:42 PM
To: Joel R. Helgeson
Subject: Re: [Full-disclosure] .NET REMOTING on port 31337

 

Yeah! Stand there and risk come confidential data being compromised! Monitor
and Capture them stealing our customer info! Then try and get it back!

Come on man. It's a pen-test, and there are NDA's in order. Don't take the
chance. 

Fabrizio

On 9/28/07, Joel R. Helgeson <joel () helgeson com> wrote:

I disagree, don't block access to the port. Monitor and capture it.

 

Joel's First rule of forensics: Don't just do something, stand there!

 

Watch it, monitor it. If it is a crafty backdoor, there are dozens of others
to enable bad guys to regain entry.

Blocking lets the hacker know you might be on to them.  IF it is legit, then
it could cause a problem.

Telnet to the port, see what it says on connection; run fport or
sysinternals utilities on the box to see the stack the program uses.

 

-joel

 

From: full-disclosure-bounces () lists grok org uk
<mailto:full-disclosure-bounces () lists grok org uk>
[mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Fabrizio
Sent: Friday, September 28, 2007 1:31 PM
To: Full-Disclosure
Subject: Re: [Full-disclosure] .NET REMOTING on port 31337

 

If you think it's that critical, (i think it's that critical) start by
blocking any connections from anywhere to that machine/port. See if anyone
complains. Check any old firewall logs for that port while you're at it.
Then continue your investigation!! 

Fabrizio

On 9/28/07, Simon Smith <simon () snosoft com> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Got output... and it was... no idea what it was... can't paste it due to
confidentiality though.

Fabrizio wrote:
> .NET Remoting is "a generic system for different applications to use to 
> communicate with one another." It's part of the .NET framework,
> obviously. (not trying to be a smart ass)
>
> I'm gonna take a wild guess and say it's not a good thing......
>
> Connect to it, and see if you get any output, if you haven't already
> done so.
>
> Fabrizio
>
>
>
> On 9/28/07, * Simon Smith* < simon () snosoft com <mailto:simon () snosoft com> 
> <mailto:simon () snosoft com>> wrote:
>
>
> Has anyone ever heard of .NET REMOTING running on port 31337? If so,
> have you ever seen it "legitimate"? 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
<http://lists.grok.org.uk/full-disclosure-charter.html> 
<http://lists.grok.org.uk/full-disclosure-charter.html>
Hosted and sponsored by Secunia - http://secunia.com/ 



> ------------------------------------------------------------------------

> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/


- --

- - simon

- ----------------------
http://www.snosoft.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iD8DBQFG/UY+f3Elv1PhzXgRAs/BAJ42Vwk5+cvWfoYo4wUl74LDnUtz7wCgzW9s
O/+SDoZYgZ1r1oDjKpKzZIo= 
=n54j
-----END PGP SIGNATURE-----

 

 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/