nmap scan - remoteanything?

miunk · Apprentice Joined: 24 Sep 2002 Posts: 199

Anyone know what "remoteanything" listening on port 4000 is? Is the fact that this is open cause for concern?

amne · Posted: Wed Aug 20, 2003 7:05 pm Post subject:

are you running mldonkey? if yes:

miunk · Apprentice Joined: 24 Sep 2002 Posts: 199

Yes I am constantly running mldonkey. And it seems that I am safe - telnet connections to my ip port 4000 from the outside fail.

Is there any danger that someone could spoof that they are actually connecting from localhost?

zhenlin · Veteran Joined: 09 Nov 2002 Posts: 1361

No. Even if they did, the recieving end would be at 127.0.0.1 as well.

That's the thing about TCP/IP. Spoofing your IP is only good for DoS attacks.

devon · l33t Joined: 23 Jun 2003 Posts: 943

If the person knew the commands and what happens, he/she doesn't need output from the server. I can telnet to a mail server and make a message without ever seeing the response from the server since I know what I am doing.

So if there was a buffer overflow exploit, I don't care what the servers tells me. I would just craft a packet from 127.0.0.1 with the proper data and be done.

zhenlin · Veteran Joined: 09 Nov 2002 Posts: 1361

Yes... But, watch :-

devon · l33t Joined: 23 Jun 2003 Posts: 943

viperlin · Veteran Joined: 15 Apr 2003 Posts: 1319 Location: UK

i've been thinking about this alot since the SoBig virus came out (fakes the e-mail address and sending IP and everything in the headers)
i was wondering how it does it really.
I know how it can fake most info but how does it fake the "Received:" bit?
i assumed it was some form of IP spoof by entering your network card into promiscuous mode and changing the source address (like nmap does with the -S flag)
i've been trying it for fun but still no luck, i've been using my own smtp server and sending them to my other e-mail account and looking at the headers.
i can't figure out how i put my network card into Promiscuous mode and specify the source IP (it's done with ifconfig i think, it has the option) but cannot find the method or command to do it.
don't supose anyones played with this.

SpinDizzy · Posted: Sun Aug 31, 2003 3:28 am Post subject:

AFAIK sobig doesn't fake the sending IP headers, just the senders address. You can inject fake received headers, but they are usually easily spotted by eyeball...