CSAM: Scary ports and firewall remote administration
Last Updated: 2014-10-07 21:46:57 UTC
by Johannes Ullrich (Version: 1)
Have you ever done a "quick vulnerability" check only to discover that someone found that vulnerability before you did and already had the system compromised?
During the early stages of a vulnerability scan, nmap is your friend just to quickly confirm what you got. In this case, the big surprise was that the firewall responded on port 4444. Anybody who ever dabbled with pentesting may be familiar with this port: Metasploit uses port 4444 by default for its remote shell. Other then that, it is typically not used by any "well known service".
At this point, with a possible compromised network firewall, there isn't much point in going much further. A quick connect with netcat oddly enough let to an HTTP error. Upon further investigation, it tuns out that Sophos firewalls use port 4444 for https remote administration. Typically, ports like 8000, 8080 or 8443 are used, but then again, maybe Sophos wanted to "hide" their port, or just be different.
I have several years of experience with the ASG's and now over a year with the UTM. They definitely make a very nice product these days.
Most also do not know that the Sophos UTM can be used freely in your home. Visit http://www.sophos.com and at the bottom left click Free Tools and you'll find a link for Home UTM.
No I do not work for Sophos...
Oct 10th 2014
8 years ago