[unisog] Port 33
reillyb at georgetown.edu
Tue Jun 3 19:57:42 GMT 2003
On Tue, 3 Jun 2003, E. Larry Lidz wrote:
> sbernard at gmu.edu writes:
> >I've got a compromised box that is running a service on TCP port 33. I can't
> >find anything on from Google, SANS, etc. regarding this port, except that it's
> > "supposed to be" the Display Support Protocol. Using telnet to connect to th
> >e port provides the following:
> ># telnet a.b.c.d 33
> >Trying a.b.c.d...
> >Connected to a.b.c.d.
> >Escape character is '^]'.
> > [Pressed <Enter>]
> >220 v:0.2
> >500 Not Loged in
> >telnet> close
> >Connection closed.
> >Has anyone else seen this?
> An ftp server. The codes (220, 500) are a give away.
Other protocols also use 220 and 500 response codes (e.g. SMTP, HTTP,
etc.). 220 is typically "Server Ready", 500 is "Error". But I agree,
it's probably an FTP server.
More information about the unisog