Login or Register to Ask a Question and Join Our Community


HP-UX

Found service running during audit

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems HP-UX Found service running during audit
# 1  
Old 01-28-2008
Found service running during audit
Hello all!

During a network audit, I came across a host running a service on a high port (34604). Not recognizing the port, I used a tool called 'amap' (THC-AMAP - fast and reliable application fingerprint mapper) to fingerprint it.

This tool also did not fingerprint it correctly, but did manage to get a response from the service.

Here is the output:
0000: 0000 0001 412e 3031 2e31 3500 6674 7000 [ ....A.01.15.ftp. ]
0010: 6365 6420 4469 736b 2041 7272 6179 2073 [ ced Disk Array s ]
0020: 6572 6961 6c20 6e75 6d62 6572 203f 3a20 [ erial number ?: ]
0030: 4561 723a 3a4c 6973 7465 6e28 2930 3030 [ Ear::Listen()000 ]
0040: 3030 3132 3042 3846 3600 0000 000d 0000 [ 00120B8F6....... ]
0050: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0060: 00bc 0004 1000 0000 0000 0000 0000 0000 [ ................ ]
0070: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0080: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0090: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00a0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00b0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00c0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00d0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
00e0: 0000 0000 0000 0000 0000 0000 0000 4003 [ ..............@. ]
00f0: 7980 0000 0000 0000 00b1 0003 0000 0000 [ y............... ]
0100: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0110: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0120: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0130: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0140: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0150: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0160: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0170: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0180: 0003 2f76 6172 2f6f 7074 2f68 7061 7272 [ ../var/opt/hparr ]
0190: 6179 2f61 646d 696e 2f30 3030 3030 3132 [ ay/admin/0000012 ]
01a0: 3042 3846 362e 0000 0000 0000 0000 0000 [ 0B8F6........... ]
01b0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
01c0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
01d0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
01e0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
01f0: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0200: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0210: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0220: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0230: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0240: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0250: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0260: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0270: 0000 0000 0000 0000 0000 0000 0000 0000 [ ................ ]
0280: 0000 0000 0000 00 [ ....... ]

I started googling around for the string "/var/opt/hparray" and I found a lot of resourced for AutoRAID controllers.

Unfortunately, i could not find any information about a remote client that could be used to connect this service. (ie. nothing with port numbers etc)

Does anyone know of such a piece of software, or am I on the complete wrong track here?

Much thanks!

-dan
# 2  
Old 01-28-2008
Run:
lsof -i :34604
to see what process has that port open.
# 3  
Old 01-29-2008
Unfortunately I do not have a login to the machine. As I said, I'm doing a network audit and ran across this. I'd love to learn more about this service so I can pass that knowledge on to my client.

I'm naturally going to advise a firewall, but I think having more information about what this service is would be very helpful.

Has anyone ever used a storage controller (san or otherwise) that has a remote management port?

Thanks everyone.

-dan
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Checking to see if windows service is running

Hi I have created a PowerShell script which successfully checks whether windows service pgsql-9.2 is running. I have tried to call that PowerShell script with a shell/bash script within a LINUX machine but have been unsuccessful. Is there a way of a shell/Perl script to check whether a... (5 Replies)
Discussion started by: simpsa27
5 Replies

2. Solaris

Checking if service is running

Hi, For audit reasons, I need to stop the web server service in some Solaris servers. The port that is listening for this service is port 10000. This is the output that shows the port 10000 is open in the server : # netstat -an | grep 10000 10.70.21.144.10000 10.70.21.133.58130 49640... (6 Replies)
Discussion started by: anaigini45
6 Replies

3. Red Hat

How a service is always running ?

Hi How ssh service at all levels always running in her file /etc/inittab? vi /etc/inittab 10::respawn:/etc/init.d/sshd I added this line & save run init q But it did not (6 Replies)
Discussion started by: mnnn
6 Replies

4. Solaris

Configuring 'auditd' service to not store the audit logs in /var partition

Hello all, I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine. However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path. So, Is there anyway to stop... (2 Replies)
Discussion started by: Anti_Evil
2 Replies

5. Red Hat

TSM service not found

Hello, I have some trouble checking the TSM ( Tivoli storage Mgr )service status in Linux box when i am doing service tsm status -bash: service command not found Above command is working fine in all other linux box ( Any idea how to look into this to resolve this, i am clueless from... (2 Replies)
Discussion started by: saurabh84g
2 Replies

6. AIX

When AIX audit start, How to set the /audit/stream.out file size ?

Dear All When I start the AIX(6100-06)audit subsystem. the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB. It will replace the original /audit/stream.out (or /audit/trail). Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies

7. Red Hat

HP Service Guard SGLX for linux getting error as LICENSE FILE NOT FOUND

HI All, I am using RHEL 5.0 32 Bit, i was trying to install HP Service Guard Cluster in my machine where i installed RHEL5. The problem is that when i am running cmquery -n selva -C mycluster.ascii. Its output is that LICENSE FILE NOT FOUND, so exiting. So i have tried so many things. Pls... (1 Reply)
Discussion started by: skumar7466
1 Replies

8. Red Hat

Cannot start httpd service `GLIBC_2.4' not found (required by /lib/libgcc_s.so.1)

# service httpd start Starting httpd: Syntax error on line 6 of /etc/httpd/conf.d/php.conf: Cannot load /etc/httpd/modules/libphp4.so into server: /lib/tls/libc.so.6: version `GLIBC_2.4' not found (required by /lib/libgcc_s.so.1) I... (2 Replies)
Discussion started by: getrue
2 Replies

9. UNIX for Dummies Questions & Answers

check service is running at boot

dears am having solaris 10, and i would like to know if the NTP service is running when the OS staritng?on the other hand how can i make it start at the boot up?note the ntp is managed by the SMF in solaris 10. thanks a lot (2 Replies)
Discussion started by: thehero
2 Replies

10. Solaris

How to be sure the dns service is running ?

Well, i changed my lan card and finally i got it up and running, i have /etc/resolv.conf with domain xxx.xxx nameserver xxx.xxx.xxx.xxx and it was working with me earlier with the old lan card, with the new one i added it ip using auto-dhcp and its received an ip from my dhcp and it can ping... (4 Replies)
Discussion started by: XP_2600
4 Replies
Login or Register to Ask a Question