Unusual ports found in nmap scan

From: kiwi99@hushmail.com
Date: 02/27/02 

From: kiwi99@hushmail.com
To: pen-test@securityfocus.com
Date: Wed, 27 Feb 2002 10:12:01 -0800

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello All

I'm currently pentesting a client and nmap reports that a particular host has the following ports open:
82/tcp
445/tcp
447/tcp

All other ports are filtered - the host is behind a Check Point firewall.
Nmap OS identification states it's very unreliable as it can't find a closed port, but suggests FreeBSD or D-Link.

The IP address has no DNS name, and as you can see no web/mail services are running (these are handled by other servers on the subnet).

RFC1700 states that these ports are xfer, microsoft-ds and DDM-RDB respectively. Clearly the client could be running anything on these ports - netcat reveals no banner information at all.

I can't find any meaningful info on the xfer utility.
DDM-RDB information suggests that it's an AS/400 protocol.
That's rather contradicted by microsoft-ds which implies it's a Win2K box.

Does anyone have any further information on these ports and what sort of application might be running using these open ports (assuming they are what they say they are!)

Also assuming it's Win2K are there any tools for enumeration on port 445?

All help appreciated

Dave

Hush provide the worlds most secure, easy to use online applications - which solution is right for you?
HushMail Secure Email http://www.hushmail.com/
HushDrive Secure Online Storage http://www.hushmail.com/hushdrive/
Hush Business - security for your Business http://www.hush.com/
Hush Enterprise - Secure Solutions for your Enterprise http://www.hush.com/

-----BEGIN PGP SIGNATURE-----
Version: Hush 2.1
Note: This signature can be verified at https://www.hushtools.com

wlsEARECABsFAjx9Ic4UHGtpd2k5OUBodXNobWFpbC5jb20ACgkQHE/0wvT4MVRnPwCf
UZTDj9+KVg3PYlYCQbDjeIldekIAn3PG/zwvpnGK53FX1Zvolh3nZrQW
=zz2v
-----END PGP SIGNATURE-----

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • Re: Finally, a secure computer
    ... adding ICF to ZoneAlarm is probably not going to add extra security. ... trouble downloading updates [I'm not sure about AVG pro, ... There are 130,000 TCP and UDP ports and it ... Your configuration sounds pretty secure, though you never know what new ...
    (microsoft.public.inetserver.iis.security)
  • OT: What will he do next?
    ... That was National Security. ... President Bush said Tuesday that a deal allowing an Arab company to take ... Senate Republican Leader Bill Frist urged the administration to ... Ports World, a state-owned business in the United Arab Emirates. ...
    (comp.sys.hp.mpe)
  • Re: Political Analysis of Security Products
    ... > bee collected nor has any evidence of such a backdoor ever really been ... send several packets to ports on the target system. ... be used for booth sides of the security game. ...
    (Pen-Test)
  • Re: Finally, a secure computer
    ... paranoia in the security aspects of IIS administration. ... security at the IBM website is compromised, ... I ran a port check on 10,000 plus ports (I ... > trouble downloading updates [I'm not sure about AVG pro, ...
    (microsoft.public.inetserver.iis.security)
  • Re: Port security, continued
    ... CITING NATIONAL SECURITY, ... WASHINGTON - PRESIDENT BUSH WAS UNAWARE OF THE PENDING SALE ... THE WHITE HOUSE SAID WEDNESDAY. ... EMERGENCY LEGISLATION TO SUSPEND THE PORTS DEAL. ...
    (sci.med.transcription)