CSAM: Scary ports and firewall remote administration

Published: 2014-10-07
Last Updated: 2014-10-07 21:46:57 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

Have you ever done a "quick vulnerability" check only to discover that someone found that vulnerability before you did and already had the system compromised?

During the early stages of a vulnerability scan, nmap is your friend just to quickly confirm what you got. In this case, the big surprise was that the firewall responded on port 4444. Anybody who ever dabbled with pentesting may be familiar with this port: Metasploit uses port 4444 by default for its remote shell. Other then that, it is typically not used by any "well known service". 

At this point, with a possible compromised network firewall, there isn't much point in going much further. A quick connect with netcat oddly enough let to an HTTP error. Upon further investigation, it tuns out that Sophos firewalls use port 4444 for https remote administration. Typically, ports like 8000, 8080 or 8443 are used, but then again, maybe Sophos wanted to "hide" their port, or just be different.

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

Keywords:
1 comment(s)

Comments

Actually, Sophos inherited the configuration for TCP 4444 from Astaro Corporation when they purchased them. The Astaro Security Gateway (ASG) programming later came to market with the Sophos Unified Threat Management (UTM) branding. I would NOT recommend assigning the remote admin port to the public WAN interface though, that is just asking for alerts and potential problems. VPN into it and them come back to the remote admin port from the inside.

I have several years of experience with the ASG's and now over a year with the UTM. They definitely make a very nice product these days.

Most also do not know that the Sophos UTM can be used freely in your home. Visit http://www.sophos.com and at the bottom left click Free Tools and you'll find a link for Home UTM.

No I do not work for Sophos...

Thanks,
Jim

Diary Archives