Printable View
I am doing penetration testing on my network to make it more secure. I used nmap v3.93 and found an open port 5101. The service it says it is running was admdog. After a google search to find out what it was, I came across it being Yahoo Messenger. What do I do now that I found the open port? If I wanted to exploit it, what do I need to do? Or If I wanted to secure it?
Yahoo Messenger version 5,0,0,1064 had several vulnerabilities,
A buffer overflow in the URI handler and the "addview" function allows for the automatic execution of malicious script contained in web pages
What could happen:
A remote attacker can execute arbitrary code with the privileges of the victim user, cause a denial of service, or modify data in the victim's "buddy" list.
What you can do:
Upgrade to the latest version
Implement a firewall with filtering.
"Yahoo Messenger listens for peer-to-peer requests on port 5101/TCP but users can implement a firewall to block inbound and outbound access to port 5101/TCP. However, since Yahoo Messenger URI's can be embedded in a web site or email message, blocking requests to and from port 5101/TCP is not a completely effective solution. Mail and Internet filters should also be applied to filter the "ymsgr:" URI handler from email messages and web sites."
Yahoo encourages users to upgrade to the latest version whenever prompted by the AutoUpdater or regularly check for updated versions of the client at http://messenger.yahoo.com.
Basicaly if you want to use Yahoo Messenger you cannot close the port!
If you want the port closed, dont use Yahoo Messenger
That would very much depend on whether or not Yahoo Messenger is indeed listening on that port.
It would also depend on your operating system, and indeed which version of messenger (or whatever is running on that port) you are using. Check the CVE and bugtraq and such docs for any vulnerabilities associated with the aplpication listening on that port. Then you can asses whether or not you are vulnerable.
Of course, the best way to secure it would be to turn off whatever is listening on that port, however, that may not be an option. You can also limit access to that port to individual hosts.
The best method to secure it, or attack it, would also greatly depend on whether you were scanning a firewall, a NAT server, or a machine directly connected with a public address. How many firewalls did you travel through to get there? How many machines, routers, and gateways are between the listening application and anyone whoi may see it?
There are any number of ways both to attack and defend an arbitrary port. The first step, of course, is footprinting - determine what is listening and how it is or is not vulnerable.
I went through a cable router and norton firewall. Thats all!
Hi CALIPTIX™
Well, that isn't that unusual, if they are not set to filter or block the traffic? I would suggest that you need to look at your configuration/settings.Quote:
I went through a cable router and norton firewall. Thats all!
It's a bit like an office with a telephonist and a secretary............the telephonist filters and routes the calls and the secretary blocks them. Both can let them get through depending on office policy and your instructions?
:)
Here's is some ancient history on Yahoo! hacking from a good friend of mine. It may help lay the foundation of knowledge with the Y! protocol.
http://loopy.org/yahoo.html