Port scans on port 137 and 17300

[Gus]

any one else seeing a lot of port scans on these 2 ports, I have Zonelalarm
running and just seem to be getting mainly these 2 ports being hit all the
time, I remember some time back that a worm was using port 137, the name
eludes me at the moment, not that it matters, but just surprised as to the
amount on the higher port, 2 seem to hit 137 then several on 17300, not
that I'm too bothered, ZA seems to be blocking them, just checked the log
and saw how many are coming in this last week... lots of them in fact.

Cheers
Gus

 

[StarScripter]

==> *Gus* from: Gus@Sick_of_Spam.au
==> scribbled in: [email protected]

any one else seeing a lot of port scans on these 2 ports, I have
Zonelalarm running and just seem to be getting mainly these 2 ports being
hit all the time, I remember some time back that a worm was using port
137, the name eludes me at the moment, not that it matters, but just
surprised as to the amount on the higher port, 2 seem to hit 137 then
several on 17300, not that I'm too bothered, ZA seems to be blocking
them, just checked the log and saw how many are coming in this last
week... lots of them in fact.

Cheers
Gus

Hi,
Scans on Port 17300 trojan/worm:
http://www.trojanforge.net/showthread/t-5373.html
http://vil.mcafee.com/dispVirus.asp?virus_k=100282

 

[Gus]

I always see a large amount of activity on NetBIOS over IP ports.
That is why I block 135 ~139 and 445 on my Linksys Router.
I have no idea of anything using 17300, and its not listed on:
http://www.simovits.com/trojans/trojans.html

Dave

FWIN,2003/07/26,21:46:30 +10:00
GMT,81.98.156.195:1950,203.164.216.158:17300,TCP (flags:S)
FWIN,2003/07/26,21:49:26 +10:00
GMT,62.234.62.250:1594,203.164.216.158:17300,TCP (flags:S)
FWIN,2003/07/26,21:53:56 +10:00
GMT,203.162.142.108:2771,203.164.216.158:17300,TCP (flags:S)
FWIN,2003/07/26,22:02:54 +10:00
GMT,61.172.9.137:4803,203.164.216.158:17300,TCP (flags:S)
FWIN,2003/07/26,22:03:14 +10:00
GMT,62.46.65.108:4501,203.164.216.158:17300,TCP (flags:S)
FWIN,2003/07/26,22:11:46 +10:00
GMT,217.129.160.158:4732,203.164.216.158:17300,TCP (flags:S)
FWIN,2003/07/26,22:13:40 +10:00
GMT,217.230.226.82:1025,203.164.216.158:137,UDP
FWIN,2003/07/26,22:14:30+10:00
GMT,203.162.142.108:4894,203.164.216.158:17300,TCP (flags:S)


Interesting, thanks for the reply,
As you can see that port is getting a few scans...

I will have a look at the link to see what else is there.

Gus

 

[Gus]

http://vil.mcafee.com/dispVirus.asp?virus_k=100282

thanks, having a read now,
Gus

 

[David H. Lipman]

Thanx !
Dave

| Scans on Port 17300 trojan/worm:
| http://vil.mcafee.com/dispVirus.asp?virus_k=100282
|
| --
| Cheers,
| Star

 

[John Coutts]

any one else seeing a lot of port scans on these 2 ports, I have Zonelalarm
running and just seem to be getting mainly these 2 ports being hit all the
time, I remember some time back that a worm was using port 137, the name
eludes me at the moment, not that it matters, but just surprised as to the
amount on the higher port, 2 seem to hit 137 then several on 17300, not
that I'm too bothered, ZA seems to be blocking them, just checked the log
and saw how many are coming in this last week... lots of them in fact.

Cheers
Gus

**************** REPLY SEPARATER ****************
Monitoring for traffic on ports that you don't support is rather useless. Go to
a DOS window and type in "netstat -an". The listening ports listed are the only
ones you need to be concerned about. If you have NetBios enabled, UDP ports 137
& 138, and TCP port 139 will be listening. Using port 137, a remote machine can
gain a little NetBios information about you, but that's all. If you have open
or poorly protected shares, a remote machine can access those through port 139.
If you aren't listening on port 17300, then why have ZA monitor it? Nobody can
use it anyway!

 

[mitundergrad]

any one else seeing a lot of port scans on these 2 ports, I have Zonelalarm
running and just seem to be getting mainly these 2 ports being hit all the
time, I remember some time back that a worm was using port 137, the name
eludes me at the moment, not that it matters, but just surprised as to the
amount on the higher port, 2 seem to hit 137 then several on 17300, not
that I'm too bothered, ZA seems to be blocking them, just checked the log
and saw how many are coming in this last week... lots of them in fact.

137: NETBIOS-NS - NETBIOS Name Service
17300: RAT: Kuang2 The Virus

 

[Gus]

**************** REPLY SEPARATER ****************
Monitoring for traffic on ports that you don't support is rather useless. Go to
a DOS window and type in "netstat -an". The listening ports listed are the only
ones you need to be concerned about. If you have NetBios enabled, UDP ports 137
& 138, and TCP port 139 will be listening. Using port 137, a remote machine can
gain a little NetBios information about you, but that's all. If you have open
or poorly protected shares, a remote machine can access those through port 139.
If you aren't listening on port 17300, then why have ZA monitor it? Nobody can
use it anyway!

**************** REPLY SEPARATER ****************

Ok, doing netstat -an > test.txt returned this result....


Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:1177 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1198 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1521 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:137 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:138 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:139 0.0.0.0:0 LISTENING
TCP 203.164.216.158:1590 210.49.20.168:110 TIME_WAIT
TCP 203.164.216.158:1592 216.136.173.10:110 TIME_WAIT
TCP 203.164.216.158:1595 210.49.20.168:110 TIME_WAIT
TCP 203.164.216.158:1597 216.136.173.10:110 TIME_WAIT
TCP 203.164.216.158:137 0.0.0.0:0 LISTENING
TCP 203.164.216.158:138 0.0.0.0:0 LISTENING
TCP 203.164.216.158:139 0.0.0.0:0 LISTENING
TCP 203.164.216.158:1177 210.49.20.254:119 ESTABLISHED
TCP 203.164.216.158:1198 210.49.20.254:119 ESTABLISHED
TCP 203.164.216.158:1521 210.49.20.254:119 ESTABLISHED
UDP 192.168.10.xx:137 *:*
UDP 192.168.10.xx:138 *:*
UDP 203.164.216.158:137 *:*
UDP 203.164.216.158:138 *:*

obviously My I.P is 203.164.216.158 and my machine seems to be listening on
137/8/9 on my network I.P as well as my net connection...
As for what ZA listens to is up to the program, I have not blocked or allowed
any particular ports, it just blocks anything it deems neccessary, by
default. I dont normally bother with the log and I have the alerts turned off
as default, but I decided to have a look just to see what was happening in
the log and came across the activity on port 137 and 17300....

maybe I'm mistaken but there seems to be the ability for the Kuang2 trojan to
access via port 17300 reading a bit on one of the links that was posted
previously..

What is your interpretation of the above result?

 

[Bill Bradshaw]

I am also trying to understand this and not having much luck. So this is my
information.

netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
TCP 127.0.0.1:8080 0.0.0.0:0 LISTENING
TCP 209.124.129.xx:137 0.0.0.0:0 LISTENING
TCP 209.124.129.xx:138 0.0.0.0:0 LISTENING
TCP 209.124.129.xx:139 0.0.0.0:0 LISTENING
UDP 209.124.129.xx:137 *:*
UDP 209.124.129.xx:138 *:*

From TCPView:

TCP oemcomputer:1025 oemcomputer:0 LISTENING
TCP oemcomputer:8080 oemcomputer:0 LISTENING
TCP 209-124-129-xxx.cherry.dialup.arctic.net:137 oemcomputer:0 LISTENING
TCP 209-124-129-xxx.cherry.dialup.arctic.net:138 oemcomputer:0 LISTENING
TCP 209-124-129-xxx.cherry.dialup.arctic.net:nbsession oemcomputer:0
LISTENING
UDP 209-124-129-xxx.cherry.dialup.arctic.net:nbname *:*
UDP 209-124-129-xxx.cherry.dialup.arctic.net:nbdatagram *:*

Art what does the nbsession, nbname, and nbdatagram stand for?

 

[John Coutts]

Ok, doing netstat -an > test.txt returned this result....


Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:1177 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1198 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1521 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:137 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:138 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:139 0.0.0.0:0 LISTENING
TCP 203.164.216.158:1590 210.49.20.168:110 TIME_WAIT
TCP 203.164.216.158:1592 216.136.173.10:110 TIME_WAIT
TCP 203.164.216.158:1595 210.49.20.168:110 TIME_WAIT
TCP 203.164.216.158:1597 216.136.173.10:110 TIME_WAIT
TCP 203.164.216.158:137 0.0.0.0:0 LISTENING
TCP 203.164.216.158:138 0.0.0.0:0 LISTENING
TCP 203.164.216.158:139 0.0.0.0:0 LISTENING
TCP 203.164.216.158:1177 210.49.20.254:119 ESTABLISHED
TCP 203.164.216.158:1198 210.49.20.254:119 ESTABLISHED
TCP 203.164.216.158:1521 210.49.20.254:119 ESTABLISHED
UDP 192.168.10.xx:137 *:*
UDP 192.168.10.xx:138 *:*
UDP 203.164.216.158:137 *:*
UDP 203.164.216.158:138 *:*

obviously My I.P is 203.164.216.158 and my machine seems to be listening on
137/8/9 on my network I.P as well as my net connection...
As for what ZA listens to is up to the program, I have not blocked or allowed
any particular ports, it just blocks anything it deems neccessary, by
default. I dont normally bother with the log and I have the alerts turned off
as default, but I decided to have a look just to see what was happening in
the log and came across the activity on port 137 and 17300....

maybe I'm mistaken but there seems to be the ability for the Kuang2 trojan to
access via port 17300 reading a bit on one of the links that was posted
previously..

What is your interpretation of the above result?

***************** REPLY SEPARATER *****************
There is obviously some duplication in the display, but the essence of it is
that you have 6 ports listening:
TCP 0.0.0.0:1177 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1198 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1521 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:137 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:138 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:139 0.0.0.0:0 LISTENING
The time wait ports are POP3 ports that you used but are currently timing out.
You made 3 accesses to your news server on nntp port 119, for which your
winsock dynamically assigned 3 ports above 1023. They will time out when those
connections are closed. If you were to close your running programs and leave
the system idle for a while, all you would see is the NetBios ports. The IP
address (192.168.xxx.xxx) indicates that you are running 2 interfaces, one with
a public address and one with a private address. Since NetBios is running on
the private network, you are not vulnerable to the outside world.

But you would be better off with a dedicated NAT router rather than relying on
ZA. Firewall software is notoriously unreliable.

J.A. Coutts

 

[David H. Lipman]

It means you are using windows and you have ports 137 ~ 139 open, Specifically NetBIOS
Session, NetBIOS DataGram and NetBIOS Name. A good way to demonstrate these protocols is
the use of the Win32 command, NBTstat .

You can get the syntax by executing; nbtstat -?

You can see NetBIOS information about a TCP/IP address by executing; nbtstat -A IP_Address.
(that's a capital letter 'A' switch parameter). The IP address of this PC is 192.168.1.99 ,
therefore, if I type; nbtstat -A 192.168.1.99

I get....

Local Area Connection 3:
Node IpAddress: [192.168.1.99] Scope Id: []

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
LIPPY <20> UNIQUE Registered
LIPPY <00> UNIQUE Registered
SEAVIEW <00> GROUP Registered
SEAVIEW <1E> GROUP Registered
LIPPY <03> UNIQUE Registered
SEAVIEW <1D> UNIQUE Registered
..__MSBROWSE__.<01> GROUP Registered

MAC Address = 00-60-08-05-98-BE

My MAC MAC Address = 00-60-08-05-98-BE
My PC name=LIPPY
My MS Networking workgroup(or NT Damain)=SEAVIEW
The PC has been made a "master browser" as indicated by ..__MSBROWSE__.

The number surrounded by <> such has <20> have specific meanings as type of NetBIOS (SMB)
services

Another form of this command is the -c or NetBIOS cache

If you execute; nbtstat -c you will then see the contents of your PC's NetBIOS cache

If the time in the right column is; -1
the host was loaded statically via the 'lmhosts' table located in the ./etc directory.

If the time is a postive number, then a node (Internet or LAN) has probed or communicated
with you using NetBIOS.

If you are a singular PC not part of a LAN and you see many nodes in the NetBIOS cache that
you are clueless about, than you can see your vulnerability to hackers and NetBIOS worms
seeking MS Networking shares that are not locked down. Often Internet worms will apply
dictionary attacks against a NetBIOS share (SMB Share) to gain entry and infect your PC.

If you are a singular PC. There is no need for NetBIOS over IP. If you participate in a MS
Networking LAN then you need to filter out these ports via the use of a FireWall. As I
stated earlier in this thread, that's why I block TCP/UDP ports 135 ~ 139 and 445 on my
Linksys Router (BEFSR41 via URL: http://192.168.1.1/Filters.htm )

From the TCP/IP 'services' table found in a ./etc directory...

loc-srv 135/tcp Location Service
profile 136/tcp
netbios-ns 137/tcp
netbios-dgm 138/tcp
netbios-ssn 139/tcp
microsoft-ds 445/tcp Microsoft-DS
loc-srv 135/udp Location Service
profile 136/udp
netbios-ns 137/udp
netbios-dgm 138/udp
netbios-ssn 139/udp
microsoft-ds 445/udp Microsoft-DS

~~~~~~~~~~~~

Dave

 

[null]

I am also trying to understand this and not having much luck. So this is my
information.

netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING

Dunno about this one. Did you do netstat -an after a reboot and fresh
connect to the internet? Have you ever logged outgoing over a long
period of time using something like Sygate's personal firewall?

TCP 127.0.0.1:8080 0.0.0.0:0 LISTENING

Looks like you have a proxy such as Proxomitron or WebWasher running?

TCP 209.124.129.xx:137 0.0.0.0:0 LISTENING
TCP 209.124.129.xx:138 0.0.0.0:0 LISTENING
TCP 209.124.129.xx:139 0.0.0.0:0 LISTENING
UDP 209.124.129.xx:137 *:*
UDP 209.124.129.xx:138 *:*

Just plain old TCP/IP bound to NetBios as usual. M$ believes everyone
should be local networking by default You have a Open Port 139
which you should attend to if you're not on a LAN. At least make sure
File and Print sharing is turned off if you're not on a LAN. But it's
far better to do the rebinding that I've mentioned in a different
post.

From TCPView:

I see Dave has addressed your question on that.

Art
http://www.epix.net/~artnpeg

 

[null]

I am also trying to understand this and not having much luck. So this is my
information.

Read this for background info:

http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html.en

Closing unneeded/unwanted services and thus closing all ports on Win2K
and XP is a bit more involved than on earlier OS.

Art
http://www.epix.net/~artnpeg

 

[Gus]

(e-mail address removed) (John Coutts) wrote in

says...
***************** REPLY SEPARATER *****************
There is obviously some duplication in the display, but the essence of it is
that you have 6 ports listening:
TCP 0.0.0.0:1177 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1198 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1521 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:137 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:138 0.0.0.0:0 LISTENING
TCP 192.168.10.xx:139 0.0.0.0:0 LISTENING
The time wait ports are POP3 ports that you used but are currently timing out.
You made 3 accesses to your news server on nntp port 119, for which your
winsock dynamically assigned 3 ports above 1023. They will time out when those
connections are closed. If you were to close your running programs and leave
the system idle for a while, all you would see is the NetBios ports. The IP
address (192.168.xxx.xxx) indicates that you are running 2 interfaces, one with
a public address and one with a private address. Since NetBios is running on
the private network, you are not vulnerable to the outside world.

But you would be better off with a dedicated NAT router rather than relying on
ZA. Firewall software is notoriously unreliable.

J.A. Coutts

Thanks for the reply John, as I said up in an earlier post I let the machine
stand idle and did another netstat...
and appreciate the advice too.
Gus

 

[Bill Bradshaw]

I am running Win98SE on a stand alone machine. Where is NetBIOS being
loaded and do I need to load it?

 

[Bill Bradshaw]

I have mixed my answers in the text below.

--
<Bill>

Brought to you from beautiful Unalaska/Dutch Harbor, Alaska.
N 53° 51.140' W 166° 30.228' (WGS 84)

Dunno about this one. Did you do netstat -an after a reboot and fresh
connect to the internet? Have you ever logged outgoing over a long
period of time using something like Sygate's personal firewall?

Port 1025 shows up everytime. I use ZoneAlarm and have checked several
weeks worth of logs and cannot find an outgoing on port 1025. Did have a
couple of probes from port 1025 but they were blocked.

Looks like you have a proxy such as Proxomitron or WebWasher running?

I am running WebWasher. How were you able to figure this out?

Just plain old TCP/IP bound to NetBios as usual. M$ believes everyone
should be local networking by default You have a Open Port 139
which you should attend to if you're not on a LAN. At least make sure
File and Print sharing is turned off if you're not on a LAN. But it's
far better to do the rebinding that I've mentioned in a different
post.

If I go into my TCP/IP properties I cannot change anything under the NetBios
tab. It is checked but also grayed out so it cannot be changed. I just
assumed this means NetBios is not installed because it does not show up as a
network component. All sharing has always been turned off.

I have bookmarked the rebinding URL and will try that out.

If I sound confused it is because I am.

 

[null]

Port 1025 shows up everytime. I use ZoneAlarm and have checked several
weeks worth of logs and cannot find an outgoing on port 1025. Did have a
couple of probes from port 1025 but they were blocked.


I am running WebWasher. How were you able to figure this out?

I also use a proxy so I know what netstat -an shows for it. It's the
only item showing on my PC.

If I go into my TCP/IP properties I cannot change anything under the NetBios
tab. It is checked but also grayed out so it cannot be changed. I just
assumed this means NetBios is not installed because it does not show up as a
network component. All sharing has always been turned off.

I have bookmarked the rebinding URL and will try that out.

If I sound confused it is because I am.

Yes you are confused. It's not a matter of uninstalling NetBios. It's
a matter of rebinding. Read through Steve Gibson's long winded
explanation and procedure for Win 9x a few times until it starts to
sink in:

http://grc.com/su-rebinding9x.htm

When you are done, netstat -an will no longer show anything for ports
137 through 139 and the ports will be closed.

Art
http://www.epix.net/~artnpeg

 

[Nick FitzGerald]

Apparently the URL I have been using is not up to date. Do you know of any URLs that tracks
TCP/UDP ports to Trojans and is kept up to date ?

To be frank, I think such lists are a waste of time for precisely the same
reason a list of "virus file names" would be entirely useless (actually, a
list of "Trojan ports" is not _as_ useless as a list of virus file names
would be, but the reason I doubt the effort of maintaining one is worthwhile
is the same).

What I tend to do if I see reasonable evidence of a specific port I do not
recognize being used "unexpectedly" is check the port listing at SANS'
"Internet Storm Center" -- isc.sans.org Specifically, to check on port
"X" go to the URL:

http://isc.sans.org/port_details.html?port=X

(Of course, that URL should give you some kind of error -- in case it is not
clear, slot your port's number in place of the "X".)

The report is oriented to monitoring traffic for that port seen at the ISC's
monitoring stations, but the "useful" information, relative to this enquiry,
is the "services registered for this port" and the "vulnerabilities for this
port" tables in the lower-right of the page. (Although the services entries
are credited as being from Neohapsis, I believe that they also include
additional information submitted by site visitors.)

 

[David H. Lipman]

Bill:

Right Click on "Network Neighbourhood"
Highlight "Client for Microsoft Networks"
Choose Remove
Choose "OK"

Allow the PC to be rebooted.

Dave


| I am running Win98SE on a stand alone machine. Where is NetBIOS being
| loaded and do I need to load it?
| --
| <Bill>
|
| Brought to you from beautiful Unalaska/Dutch Harbor, Alaska.
| N 53° 51.140' W 166° 30.228' (WGS 84)
|
| David H. Lipman wrote:
| > It means you are using windows and you have ports 137 ~ 139 open,
| > Specifically NetBIOS Session, NetBIOS DataGram and NetBIOS Name. A
| > good way to demonstrate these protocols is the use of the Win32
| > command, NBTstat .
|
|

 

[David H. Lipman]

Thanx Nick

The info is appreciated.

Dave

| To be frank, I think such lists are a waste of time for precisely the same
| reason a list of "virus file names" would be entirely useless (actually, a
| list of "Trojan ports" is not _as_ useless as a list of virus file names
| would be, but the reason I doubt the effort of maintaining one is worthwhile
| is the same).
|
| What I tend to do if I see reasonable evidence of a specific port I do not
| recognize being used "unexpectedly" is check the port listing at SANS'
| "Internet Storm Center" -- isc.sans.org Specifically, to check on port
| "X" go to the URL:
|
| http://isc.sans.org/port_details.html?port=X
|
| (Of course, that URL should give you some kind of error -- in case it is not
| clear, slot your port's number in place of the "X".)
|
| The report is oriented to monitoring traffic for that port seen at the ISC's
| monitoring stations, but the "useful" information, relative to this enquiry,
| is the "services registered for this port" and the "vulnerabilities for this
| port" tables in the lower-right of the page. (Although the services entries
| are credited as being from Neohapsis, I believe that they also include
| additional information submitted by site visitors.)
|
| --
| Nick FitzGerald