[unisog] Port 33

Brian Reilly reillyb at georgetown.edu
Tue Jun 3 19:57:42 GMT 2003


On Tue, 3 Jun 2003, E. Larry Lidz wrote:

> 
> sbernard at gmu.edu writes:
> >I've got a compromised box that is running a service on TCP port 33.  I can't 
> >find anything on from Google, SANS, etc. regarding this port, except that it's
> > "supposed to be" the Display Support Protocol.  Using telnet to connect to th
> >e port provides the following:
> >
> ># telnet a.b.c.d 33
> >Trying a.b.c.d...
> >Connected to a.b.c.d.
> >Escape character is '^]'.
> >  [Pressed <Enter>]
> >220 v:0.2
> >?
> >500 Not Loged in
> >^]
> >telnet> close
> >Connection closed.
> >#
> >
> >Has anyone else seen this?
> 
> An ftp server. The codes (220, 500) are a give away.
> 

Other protocols also use 220 and 500 response codes (e.g. SMTP, HTTP,
etc.).  220 is typically "Server Ready", 500 is "Error".  But I agree,
it's probably an FTP server.

--Brian




More information about the unisog mailing list