Sponsored Content
Operating Systems HP-UX Found service running during audit Post 302162309 by dan.king on Monday 28th of January 2008 04:50:53 PM
Old 01-28-2008
Found service running during audit

Hello all!

During a network audit, I came across a host running a service on a high port (34604). Not recognizing the port, I used a tool called 'amap' (THC-AMAP - fast and reliable application fingerprint mapper) to fingerprint it.

This tool also did not fingerprint it correctly, but did manage to get a response from the service.

Here is the output:
0000: 0000 0001 412e 3031 2e31 3500 6674 7000 [ ....A.01.15.ftp. ]
0010: 6365 6420 4469 736b 2041 7272 6179 2073 [ ced Disk Array s ]
0020: 6572 6961 6c20 6e75 6d62 6572 203f 3a20 [ erial number ?: ]
0030: 4561 723a 3a4c 6973 7465 6e28 2930 3030 [ Ear::Listen()000 ]
0040: 3030 3132 3042 3846 3600 0000 000d 0000 [ 00120B8F6....... ]
0050: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0060: 00bc 0004 1000 0000 0000 0000 0000 0000 [ ................ ]
0070: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0080: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0090: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00a0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00b0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00c0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00d0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00e0: 0000 0000 0000 0000 0000 0000 0000 4003 [ ..............@. ]
00f0: 7980 0000 0000 0000 00b1 0003 0000 0000 [ y............... ]
0100: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0110: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0120: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0130: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0140: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0150: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0160: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0170: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0180: 0003 2f76 6172 2f6f 7074 2f68 7061 7272 [ ../var/opt/hparr ]
0190: 6179 2f61 646d 696e 2f30 3030 3030 3132 [ ay/admin/0000012 ]
01a0: 3042 3846 362e 0000 0000 0000 0000 0000 [ 0B8F6........... ]
01b0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
01c0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
01d0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
01e0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
01f0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0200: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0210: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0220: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0230: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0240: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0250: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0260: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0270: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0280: 0000 0000 0000 00 [ ....... ]

I started googling around for the string "/var/opt/hparray" and I found a lot of resourced for AutoRAID controllers.

Unfortunately, i could not find any information about a remote client that could be used to connect this service. (ie. nothing with port numbers etc)

Does anyone know of such a piece of software, or am I on the complete wrong track here?

Much thanks!

-dan
 

10 More Discussions You Might Find Interesting

1. Solaris

How to be sure the dns service is running ?

Well, i changed my lan card and finally i got it up and running, i have /etc/resolv.conf with domain xxx.xxx nameserver xxx.xxx.xxx.xxx and it was working with me earlier with the old lan card, with the new one i added it ip using auto-dhcp and its received an ip from my dhcp and it can ping... (4 Replies)
Discussion started by: XP_2600
4 Replies

2. UNIX for Dummies Questions & Answers

check service is running at boot

dears am having solaris 10, and i would like to know if the NTP service is running when the OS staritng?on the other hand how can i make it start at the boot up?note the ntp is managed by the SMF in solaris 10. thanks a lot (2 Replies)
Discussion started by: thehero
2 Replies

3. Red Hat

Cannot start httpd service `GLIBC_2.4' not found (required by /lib/libgcc_s.so.1)

# service httpd start Starting httpd: Syntax error on line 6 of /etc/httpd/conf.d/php.conf: Cannot load /etc/httpd/modules/libphp4.so into server: /lib/tls/libc.so.6: version `GLIBC_2.4' not found (required by /lib/libgcc_s.so.1) I... (2 Replies)
Discussion started by: getrue
2 Replies

4. Red Hat

HP Service Guard SGLX for linux getting error as LICENSE FILE NOT FOUND

HI All, I am using RHEL 5.0 32 Bit, i was trying to install HP Service Guard Cluster in my machine where i installed RHEL5. The problem is that when i am running cmquery -n selva -C mycluster.ascii. Its output is that LICENSE FILE NOT FOUND, so exiting. So i have tried so many things. Pls... (1 Reply)
Discussion started by: skumar7466
1 Replies

5. AIX

When AIX audit start, How to set the /audit/stream.out file size ?

Dear All When I start the AIX(6100-06)audit subsystem. the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB. It will replace the original /audit/stream.out (or /audit/trail). Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies

6. Red Hat

TSM service not found

Hello, I have some trouble checking the TSM ( Tivoli storage Mgr )service status in Linux box when i am doing service tsm status -bash: service command not found Above command is working fine in all other linux box ( Any idea how to look into this to resolve this, i am clueless from... (2 Replies)
Discussion started by: saurabh84g
2 Replies

7. Solaris

Configuring 'auditd' service to not store the audit logs in /var partition

Hello all, I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine. However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path. So, Is there anyway to stop... (2 Replies)
Discussion started by: Anti_Evil
2 Replies

8. Red Hat

How a service is always running ?

Hi How ssh service at all levels always running in her file /etc/inittab? vi /etc/inittab 10::respawn:/etc/init.d/sshd I added this line & save run init q But it did not (6 Replies)
Discussion started by: mnnn
6 Replies

9. Solaris

Checking if service is running

Hi, For audit reasons, I need to stop the web server service in some Solaris servers. The port that is listening for this service is port 10000. This is the output that shows the port 10000 is open in the server : # netstat -an | grep 10000 10.70.21.144.10000 10.70.21.133.58130 49640... (6 Replies)
Discussion started by: anaigini45
6 Replies

10. Shell Programming and Scripting

Checking to see if windows service is running

Hi I have created a PowerShell script which successfully checks whether windows service pgsql-9.2 is running. I have tried to call that PowerShell script with a shell/bash script within a LINUX machine but have been unsuccessful. Is there a way of a shell/Perl script to check whether a... (5 Replies)
Discussion started by: simpsa27
5 Replies
mlib_VideoColorYUV444seq_to_ABGRint(3MLIB)		    mediaLib Library Functions			mlib_VideoColorYUV444seq_to_ABGRint(3MLIB)

NAME
mlib_VideoColorYUV444seq_to_ABGRint - color convert YUV sequential to ABGR interleaved SYNOPSIS
cc [ flag... ] file... -lmlib [ library... ] #include <mlib.h> void mlib_VideoColorYUV444seq_to_ABGRint(mlib_u32 *ABGR, const mlib_u8 *Y, const mlib_u8 *U, const mlib_u8 *V, const mlib_u8 *A_array, mlib_u8 A_const, mlib_s32 w, mlib_s32 h, mlib_s32 dlb, mlib_s32 slb); DESCRIPTION
The Y, U, V pixel streams are converted into an ABGR pixel stream. All pixel components are 8-bit unsigned integers. All buffers have dimensions w and h. The alpha values for this function work in the following fashion: o If A_array pointer is not NULL, the values are taken from there. It has to have the same dimensions as the Y buffer. o If A_array pointer is NULL, the alpha values for every pixel are set to A_const. The following equation is used: |R| |1.1644 0.0000 1.5966| [|Y| | 16.0000|] |G| = |1.1644 -0.3920 -0.8132| * [|U| - |128.0000|] |B| |1.1644 2.0184 0.0000| [|V| |128.0000|] PARAMETERS
The function takes the following arguments: ABGR Pointer to output buffer. Y Pointer to Y input buffer. U Pointer to U input buffer. V Pointer to V input buffer. A_array Array of alpha values. A_const Constant alpha value. w Image width in pixels. h Image height in lines. dlb Linebytes for output buffer. slb Linebytes for input buffers. RETURN VALUES
None. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Interface Stability |Evolving | +-----------------------------+-----------------------------+ |MT-Level |MT-Safe | +-----------------------------+-----------------------------+ SEE ALSO
mlib_VideoColorYUV420seq_to_ARGBint(3MLIB), mlib_VideoColorYUV411seq_to_ARGBint(3MLIB), mlib_VideoColorYUV422seq_to_ARGBint(3MLIB), mlib_VideoColorYUV444seq_to_ARGBint(3MLIB), mlib_VideoColorYUV420seq_to_ABGRint(3MLIB), mlib_VideoColorYUV411seq_to_ABGRint(3MLIB), mlib_VideoColorYUV422seq_to_ABGRint(3MLIB), mlib_VideoColorYUYV422int_to_ARGBint(3MLIB), mlib_VideoColorYUV444int_to_ARGBint(3MLIB), mlib_VideoColorYUYV422int_to_ABGRint(3MLIB), mlib_VideoColorYUV444int_to_ABGRint(3MLIB), mlib_VideoColorUYVY422int_to_ARGBint(3MLIB), mlib_VideoColorUYVY422int_to_ABGRint(3MLIB), mlib_VideoColorUYV444int_to_ARGBint(3MLIB), mlib_VideoColorUYV444int_to_ABGRint(3MLIB), attributes(5) SunOS 5.10 10 Nov 2004 mlib_VideoColorYUV444seq_to_ABGRint(3MLIB)
All times are GMT -4. The time now is 07:16 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy