Port 80 listen without WebServer?

Hi,

I have a RedHat/Conectiva 8 and i runned nessus and i received the follow message:

Security Note: Port: www-http ( tcp/80)

But i don't a web server running. I runned the chkrootkit and it doesn't find nothing. The same to Clamav, that doesn't find nothing. The netstat -anp doesn't show port 80 too. But when i run the nmap from other computer, the port 80 is listening.

Anyone can help me?

Thanks

Hmm, can you paste us the nmap and the netstat results here? Maybe you are a victim of a 'cloak' attack, which means your 'netstat' application has been substituted with something malicous?

Cheers.


/edit-addon

I dont know about redhat, but try and see if you can use :

netstat -patune

make sure you run that as user root.... but first lets try and find out that your 'netstat' is what its supposed to be, so try it without root first.

You can also try bringing up your ip in a web browser to know if its a web server or alternatively telnet or ssh into port 80 on your box and see what you get. Might be interesting or shed some light on things.

I changed my original IP for one fake: 200.201.202.203

The netstat result:

Conexões Internet Ativas (servidores e estabelecidas)
Proto Recv-Q Send-Q Endereço Local Endereço Remoto Estado Usuário PID/Program name
tcp 0 0 0.0.0.0:548 0.0.0.0:* OUÇA 0 1915 1109/afpd
tcp 0 0 0.0.0.0:139 0.0.0.0:* OUÇA 0 1954 1131/smbd
tcp 0 0 0.0.0.0:111 0.0.0.0:* OUÇA 0 1029 744/portmap
tcp 0 0 0.0.0.0:22 0.0.0.0:* OUÇA 0 1162 904/sshd
tcp 0 0 0.0.0.0:3128 0.0.0.0:* OUÇA 0 1832 1052/(squid)
tcp 0 0 0.0.0.0:25 0.0.0.0:* OUÇA 0 1298 1007/master
tcp 0 0 127.0.0.1:32769 127.0.0.1:32768 ESTABELECIDA100 1573 1052/(squid)
tcp 0 0 127.0.0.1:32768 127.0.0.1:32769 ESTABELECIDA100 1574 1053/(ncsa_auth)
tcp 0 0 127.0.0.1:32771 127.0.0.1:32770 ESTABELECIDA100 1576 1052/(squid)
tcp 0 0 127.0.0.1:32770 127.0.0.1:32771 ESTABELECIDA100 1577 1054/(ncsa_auth)
tcp 0 0 200.201.202.203:22 200.201.202.204:32769 ESTABELECIDA0 2366 1234/sshd
tcp 0 0 192.168.100.1:139 192.168.100.7:1541 ESTABELECIDA0 2360 1233/smbd
tcp 0 16 192.168.100.1:548 192.168.100.2:49154 ESTABELECIDA0 2328 1230/afpd
tcp 0 0 192.168.100.1:548 192.168.100.3:49155 ESTABELECIDA0 2320 1226/afpd
tcp 0 0 127.0.0.1:32773 127.0.0.1:32772 ESTABELECIDA100 1579 1052/(squid)
tcp 0 0 127.0.0.1:32772 127.0.0.1:32773 ESTABELECIDA100 1580 1055/(ncsa_auth)
tcp 0 0 192.168.100.1:139 192.168.100.6:3074 ESTABELECIDA0 2305 1222/smbd
tcp 0 0 192.168.100.1:548 192.168.100.5:49155 ESTABELECIDA0 2310 1223/afpd
tcp 0 0 127.0.0.1:32775 127.0.0.1:32774 ESTABELECIDA100 1582 1052/(squid)
tcp 0 0 127.0.0.1:32774 127.0.0.1:32775 ESTABELECIDA100 1583 1056/(ncsa_auth)
tcp 0 0 127.0.0.1:32777 127.0.0.1:32776 ESTABELECIDA100 1585 1052/(squid)
tcp 0 0 127.0.0.1:32776 127.0.0.1:32777 ESTABELECIDA100 1586 1057/(ncsa_auth)
tcp 0 0 200.201.202.203:22 200.201.202.204:33011 ESTABELECIDA0 5599 1300/sshd
udp 0 0 127.0.0.1:32768 127.0.0.1:32769 ESTABELECIDA100 1836 1083/(pinger)
udp 0 0 127.0.0.1:32769 127.0.0.1:32768 ESTABELECIDA100 1837 1052/(squid)
udp 0 0 0.0.0.0:32770 0.0.0.0:* 100 1571 1052/(squid)
udp 0 0 127.0.0.1:32773 0.0.0.0:* 0 2306 1222/smbd
udp 0 0 127.0.0.1:32774 0.0.0.0:* 0 2361 1233/smbd
udp 0 0 200.201.202.203:137 0.0.0.0:* 0 1977 1144/nmbd
udp 0 0 192.168.100.1:137 0.0.0.0:* 0 1975 1144/nmbd
udp 0 0 0.0.0.0:137 0.0.0.0:* 0 1968 1144/nmbd
udp 0 0 200.201.202.203:138 0.0.0.0:* 0 1978 1144/nmbd
udp 0 0 192.168.100.1:138 0.0.0.0:* 0 1976 1144/nmbd
udp 0 0 0.0.0.0:138 0.0.0.0:* 0 1969 1144/nmbd
udp 0 0 0.0.0.0:3130 0.0.0.0:* 0 1833 1052/(squid)
udp 0 0 0.0.0.0:3401 0.0.0.0:* 0 1835 1052/(squid)
udp 0 0 0.0.0.0:4827 0.0.0.0:* 0 1834 1052/(squid)
udp 0 0 0.0.0.0:111 0.0.0.0:* 0 1009 744/portmap

The nmap result:
Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Host (200.201.202.203) appears to be up ... good.
Initiating Connect() Scan against 200-201-202-203
Adding open port 80/tcp
The Connect() Scan took 0 seconds to scan 1 ports.
Interesting ports on (200.201.202.203):
Port State Service
80/tcp open http

Nmap run completed -- 1 IP address (1 host up) scanned in 1 second

Thanks by help

hum, do you have a iptables redirect running on that? redirecting port 80 to squid...

Well the service in question would be "Pinger". It requires the use of a webserver and may just be providing one. Kill that process and then run nmap.

Thanks by help, but i kill the pinger and the nmap continue showing port 80. There isn't iptables redirect too.

ok, that is odd.
Did you read all netfilters entries on that machine? no redirect - ok, nat? mangle?

if not, try to run an netstat from an external disk (a trusted one). if you got a rootkit, netstat,ps and top commands are compromised.....

If its not pinger then the only other thing i would imagine it to be, is squid. Your best bet would be to kill processes and nmap afterwards to find the culprit. May not be the fastest or easiest way but its almost guaranteed to work.

You might just grab the 'lsof' utility and run it. It can tell you what service is actually using the port. The details are in the man pages, there are also plenty of tutorials for it on the net.

I get netstat command from other machine, and put on server under investigation, but port 80 not list.

The lsof -i result:
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
portmap 744 bin 3u IPv4 1009 UDP *:sunrpc
portmap 744 bin 4u IPv4 1029 TCP *:sunrpc (LISTEN)
sshd 904 root 3u IPv4 1162 TCP *:ssh (LISTEN)
master 1007 root 11u IPv4 1298 TCP *:smtp (LISTEN)
afpd 1109 root 0u IPv4 1915 TCP *:afpovertcp (LISTEN)
smbd 1131 root 11u IPv4 1954 TCP *:netbios-ssn (LISTEN)
nmbd 1144 root 10u IPv4 1968 UDP *:netbios-ns
nmbd 1144 root 11u IPv4 1969 UDP *:netbios-dgm
nmbd 1144 root 12u IPv4 1975 UDP 192.168.100.1:netbios-ns
nmbd 1144 root 13u IPv4 1976 UDP 192.168.100.1:netbios-dgm
nmbd 1144 root 14u IPv4 1977 UDP server1:netbios-ns
nmbd 1144 root 15u IPv4 1978 UDP server1:netbios-dgm
smbd 1222 vitor 5u IPv4 2306 UDP localhost.localdomain:32773
smbd 1222 vitor 14u IPv4 2305 TCP 192.168.100.1:netbios-ssn->192.168.100.6:3074 (ESTABLISHED)
afpd 1223 nobody 4u IPv4 2310 TCP 192.168.100.1:afpovertcp->192.168.100.5:49155 (ESTABLISHED)
afpd 1226 nobody 4u IPv4 2320 TCP 192.168.100.1:afpovertcp->192.168.100.3:49155 (ESTABLISHED)
afpd 1230 nobody 4u IPv4 2328 TCP 192.168.100.1:afpovertcp->192.168.100.2:49154 (ESTABLISHED)
sshd 1234 root 4u IPv4 2366 TCP server1:ssh->200-201-202-203:32769 (ESTABLISHED)
sshd 1240 carlos 4u IPv4 2366 TCP server1:ssh->200-201-202-203:32769 (ESTABLISHED)
smbd 1466 root 5u IPv4 19294 TCP 192.168.100.1:netbios-ssn->192.168.100.7:bootserver (ESTABLISHED)
smbd 1466 root 14u IPv4 19295 UDP localhost.localdomain:32798

if your behind a router it's http server is going to show up when you check from the outside

Yes, i'm behind ADSL router, what is mean?

when you nmap your machine are you doing against internet address or intranet address?
your adsl-router may have a web interface for administration....
if you have an pppoe connection and just one ethernet interface, shutdown pppoe and run nmap against eth0 interface. after, bring pppoe up and run nmap against pppx interface. report here the diferences

i'm making nmap against internet address, and the target stay behind a adsl router.

but port 80 appears on pppoe (behind the adsl-router) and on ethx (local port)?

I did a test and run nmap against ip adsl-router and the result is the egual the host ip address.

Another test, i run nmap against others three hosts with adsl connection and the result is egual. The port 80 is open or filtered on both cases.

My hosts is clean?

Thanks by help.

Port 80 is on eth0.

Sounds to me like a webmin configuration page for the router. Have you actually gone to the page?

Go to a computer outide of your network and telnet to you ip address. The command looks like this:

Quote:

---

telnet x.x.x.x 80

---

If the telnet connects, then issue this command:

Quote:

---

GET / HTTP / 1.1

---

That will give you a good bit of info right there. If it does not connect, try it in a web browser.

If not, then just look at the config for your router, for some odd reason it may have port 80 opened up. If it is and you arn't using it, close it.

If none of this works, then try back with any more info.

When i run GET / HTTP / 1.1 the connection broken.

Hmm, go to http://www.chkrootkit.org/ and get chkrootkit and run it. Just to be sure, although, i think that tedob has hit the point here. Ive not seen an understandable answer here to what tedob has said. Are you scanning the boxes in the internal network, using the internal lan ip, or the real ip?? It would help to understand your network setup a bit better.

Cheers.

The target is in the internet and i´m scanning the real IP from internet on eth0, but the target is behind adsl-router.

thanks

if both scan results are equal (scanning internet ip and scan internal ip address), i cant be the adsl-router. Port 80 must be open at host.
However, im confused. You've mencioned the "port is filtered or opened". Those 2 status are VERY diferent.
"port is opened" means that there is a process accepting connections at target host
"port is filtered" means that nmap couldnt get a response from host and its assuming that a firewall or equivalent is blocking requests to that port. I.E. if you configure netfilter with -J DROP on port 80, port will appear as "filtered".
if port is flaged as "opened", some one is accepting connections there. But if no process is listen to that port...only idea that come is a port redirect.

The port is opened and i have a iptables in this host with follow rule: iptables -P INPUT DROP

Now for the simple answer. If you're scanning from across the internet and port 80 is showing as open, don't worry about it. Lots of ISP's use transparent caching on port 80, and this is why port 80 appears to be open when in fact it's not.

To prove that port 80 isn't really open, try starting apache on the machine you scanned. If 80 is in use, apache will complain that it can't bind to the port and will refuse to run. If it starts and you can retrieve web pages from that PC, you can be sure it was appearing as open because of transparent caching.

To be doubly sure, you could use the perl script at www.cgi101.com that returns all your environment variables and view the page from the PC you used to scan from. If you don't understand what they mean, post the environment variables here, as transparent caching is very easy to spot from environment variables.

Only apache can be used for this test. I haven't apache installed on host, but i have others services, i.e. postfix, squid, samba.

Other information, i disabled ports 80/tcp and 80/udp in /etc/services

Thanks by help

hacinn. turn OFF your computer and leave the router turned on. go to someone elses computer and scan your ip address. unless you have set up the router to foward ports every reply the scan gives you will be coming from the router. if you dont have access to a scanner on anothers computer use the browser and go to your ip address: http://XX.XXX.XX.XXX. if you get a login box and you know your computer is turned off you'll have your answer

I unpluged the host target from internet and i leave router turn on. Then i ran nmap against IP address of the host (200.202.204.206), and the result show port 80 open. Then i ran nmap against router IP address and port 80 opened too.


My Host IP Internet My ADSL-router ADSL-router Target Host Target
200.201.202.204 -----> 200.201.202.200 ------->INTERNET --------> 200.202.204.205 ------->200.202.204.206
run nmap port 80 open port 80 open


I'm crazy

ok, if the host isnt there (unpluged from router) the 'open' can only be coming from the router...there is nowhere else fo it to come from. right?

use the browser on 200.201.202.204 and goto http://200.202.204.206. you'll get a login box. if you know the routers password you can get in.

I tried to browse in http://200.202.204.206 and http://200.202.204.205, but the page not cann´t be showed.

Maybe have a try with uptime.netcraft.com with your hostname and see if you get any info.

What kind of router do you have? Most home routers have a webmin page to configure it with. examples of this are linksys, netgear, d-link, etc...

regardless, go to one of your computers and check for your ip address.

Windows: ipconfig \all

linux: ifconfig -a

If your ip is 192.168.1.100, then go to a browser and try to navigate to 192.168.1.1 or 192.168.1.254.

if your ip is 192.168.0.100 then do the same thing like 192.168.0.1 and 192.168.0.254.

When (and if) you get to your router config page, remove any rules that are opening port 80 and turn of the routers config from internet function. If you need help feel free to ask more if anything is unclear.

Thanks by help for all, follow the complete description of the situation.

Host A:
- The computer where i'm running the tests with nessus and nmap.
- IP 200.200.200.201

Router R1:
- Router ADSL - does the connection of the host A with the internet.
- IP 200.200.200.202

Host B:
- The server under investigation, receive the tests with nessus and nmap.
- Linux RedHat/Conectiva 8
- IP 200.200.201.201
- Services running: Samba, Squid, Atalk, Postfix, Iptables, Snort, SSH, i haven't APACHE installed.
- The iptables is set to drop all connection, with exception of the SSH become from host A.
- In iptables has not redirect to port 80.

Router R2:
- Router ADSL - does the connection of the host B with the internet.
- IP 200.200.201.202

The Problem:
Ran the nessus from host A against host B, and i received an Security Alert information that port 80/tcp was opened and that a unknown service was running.

I started the investigation and ran the follows commands on host B:
netstat -tupan ( doesn't show port 80 )
lsof -i ( doesn't show port 80 )
fuser -n tcp 80 ( doesn't show nothing )
tcpdump dst port 80 ( there aren't traffic in this port )
chkrootkit ( doesn't detect nothing )
clamav ( doesn't find virus )
Replace the nestat for other secure and ran again the netstat -tupan, and the result was same.

- I Disabled the port 80/tcp and 80/udp on /etc/services and restart host B.

I tried an telnet to port 80 and happen this:

Trying 200.200.201.201 ....
Connected to 200.200.201.201.
Escape character is '^]'.

I did: GET / HTTP / 1.1
Then a short time, the i receveid the message.

Connection closed by foreign host.

On host A, I ran the nmap against the host B using the follow command:
nmap -vv -P0 -p 80-80 -sT 200.200.201.201

I received that port 80/tcp was opened by http service.

Then, i did the follow test, unpluged the host B of the router. On host A, I ran the same command of the nmap, against the host B IP and the result was that port 80 was opened. But how, if the host was unpluged of the internet.

Then, yet with host B out of the internet, I ran the nmap command against router R2 IP and the result was that port 80 was opened too.

I don't understand that what's happening, anyone can help me?

Follow the results of the netstat -tupan and ps ax commands.

Result of the nestat -tupan:

Conexões Internet Ativas (servidores e estabelecidas)
Proto Recv-Q Send-Q Endereço Local Endereço Remoto Estado PID/Program name
tcp 0 0 192.168.100.1:548 0.0.0.0:* OUÇA 2069/afpd
tcp 0 0 192.168.100.1:139 0.0.0.0:* OUÇA 1895/smbd
tcp 0 0 0.0.0.0:22 0.0.0.0:* OUÇA 1008/sshd
tcp 0 0 192.168.100.1:3128 0.0.0.0:* OUÇA 2149/(squid)
tcp 0 0 192.168.100.1:25 0.0.0.0:* OUÇA 1675/master
tcp 0 0 127.0.0.1:25 0.0.0.0:* OUÇA 1675/master
tcp 0 0 127.0.0.1:32898 127.0.0.1:32897 ESTABELECIDA2149/(squid)
tcp 0 0 127.0.0.1:32897 127.0.0.1:32898 ESTABELECIDA2150/(ncsa_auth)
tcp 0 0 127.0.0.1:32900 127.0.0.1:32899 ESTABELECIDA2149/(squid)
tcp 0 0 192.168.100.1:548 192.168.100.3:49155 ESTABELECIDA2247/afpd
tcp 0 0 127.0.0.1:32899 127.0.0.1:32900 ESTABELECIDA2151/(ncsa_auth)
tcp 0 48 200.200.201.201:22 200.200.200.201:32806 ESTABELECIDA1399/sshd
tcp 0 0 192.168.100.1:139 192.168.100.6:1027 ESTABELECIDA2203/smbd
tcp 0 0 127.0.0.1:32902 127.0.0.1:32901 ESTABELECIDA2149/(squid)
tcp 0 0 192.168.100.1:548 192.168.100.5:49155 ESTABELECIDA2330/afpd
tcp 0 0 127.0.0.1:32901 127.0.0.1:32902 ESTABELECIDA2152/(ncsa_auth)
tcp 0 0 127.0.0.1:32904 127.0.0.1:32903 ESTABELECIDA2149/(squid)
tcp 0 0 127.0.0.1:32903 127.0.0.1:32904 ESTABELECIDA2153/(ncsa_auth)
tcp 0 0 127.0.0.1:32906 127.0.0.1:32905 ESTABELECIDA2149/(squid)
tcp 0 0 127.0.0.1:32905 127.0.0.1:32906 ESTABELECIDA2154/(ncsa_auth)
tcp 0 0 192.168.100.1:139 192.168.100.7:1233 ESTABELECIDA1951/smbd
udp 0 0 192.168.100.1:137 0.0.0.0:* 1908/nmbd
udp 0 0 0.0.0.0:137 0.0.0.0:* 1908/nmbd
udp 0 0 192.168.100.1:138 0.0.0.0:* 1908/nmbd
udp 0 0 0.0.0.0:138 0.0.0.0:* 1908/nmbd
udp 0 0 127.0.0.1:32786 0.0.0.0:* 1951/smbd
udp 0 0 127.0.0.1:32791 127.0.0.1:32792 ESTABELECIDA2156/(pinger)
udp 0 0 127.0.0.1:32792 127.0.0.1:32791 ESTABELECIDA2149/(squid)
udp 0 0 127.0.0.1:32793 0.0.0.0:* 2203/smbd
udp 0 0 0.0.0.0:32804 0.0.0.0:* 2149/(squid)

Result of the ps ax:

4 ? SW 0:00 [kswapd]
5 ? SW 0:00 [bdflush]
6 ? SW 0:00 [kupdated]
7 ? SW< 0:00 [mdrecoveryd]
11 ? SW 0:02 [kjournald]
129 ? SW 0:00 [khubd]
256 ? SW 0:00 [kjournald]
257 ? SW 0:00 [kjournald]
701 ? SW 0:00 [eth0]
782 ? SW 0:00 [eth1]
868 ? S 0:00 syslogd -m 0
880 ? S 0:00 klogd
968 ? S 0:00 /usr/sbin/atd
988 ? S 0:00 crond
1008 ? S 0:00 /usr/sbin/sshd
1133 ttyS0 S 0:00 gpm -t ms
1314 ? R 0:08 /usr/bin/snort -d -D -i eth0 -p -l /var/log/snort -u
1319 tty1 S 0:00 /sbin/mingetty tty1
1320 tty2 S 0:00 /sbin/mingetty tty2
1321 tty3 S 0:00 /sbin/mingetty tty3
1322 tty4 S 0:00 /sbin/mingetty tty4
1323 tty5 S 0:00 /sbin/mingetty tty5
1324 tty6 S 0:00 /sbin/mingetty tty6
1399 ? S 0:00 /usr/sbin/sshd
1401 ? S 0:01 /usr/sbin/sshd
1402 pts/0 S 0:00 -bash
1415 pts/0 S 0:00 su
1416 pts/0 S 0:00 bash
1675 ? S 0:00 /usr/lib/postfix/master
1682 ? S 0:00 pickup -l -t fifo -u
1683 ? S 0:00 qmgr -l -t fifo -u
1895 ? S 0:00 smbd -D
1908 ? S 0:00 nmbd -D
1909 ? S 0:00 nmbd -D
1951 ? S 0:04 smbd -D
2043 ? S 0:00 atalkd
2056 ? S 0:00 papd
2069 ? S 0:00 afpd -c 50 -n sp
2147 ? S 0:00 /usr/bin/squid
2149 ? S 0:00 (squid)
2150 ? S 0:00 (ncsa_auth) /etc/squid/squid_passwd
2151 ? S 0:00 (ncsa_auth) /etc/squid/squid_passwd
2152 ? S 0:00 (ncsa_auth) /etc/squid/squid_passwd
2153 ? S 0:00 (ncsa_auth) /etc/squid/squid_passwd
2154 ? S 0:00 (ncsa_auth) /etc/squid/squid_passwd
2155 ? S 0:00 (unlinkd)
2156 ? S 0:00 (pinger)
2203 ? S 0:01 smbd -D
2247 ? S 0:00 afpd -c 50 -n sp
2316 ? S 0:00 smtp -t unix -u
2318 pts/0 R 0:00 ps ax

If just your adsl-router is plugged (no other host behind) and nmap from internet is still showing port 80 is opened, one of bellow is happening:

a) your adsl-router (as stated before) has a webmin interface. ask your isp (or router vendor about that)
b) your ISP is blocking port 80, but instead to deny (that it would show "filtered" status), ISP is doing some kind of trick to screw you.

Please be aware that some ISPs (adsl and cable ones) dont allow you to run any service bellow port 1024 on home connections.

you can check this by asking a friend that has the same kind of connection to allow you scan his computer.