32

I ran nmap on my server and found a strange port open. I'm trying to figure out if there is a way to map that port to a specific process but have no idea if there is such a tool.

Any suggestions?

1
  • Upvote for being #1 answer in Gogle June 2018.
    – SDsolar
    Jun 6, 2018 at 21:07

6 Answers 6

57

As well as Netstat, mentioned in other posts, the lsof command should be able to do this just fine. Just use this:

lsof -i :<port number>

and all of the processes should come up. I use it on OS X quite frequently.

Debian Administration article for lsof

6
  • interesting. I did not know about this. however, I am looking into this as the result of a hack attempt. machine is a friend's. you can telnet to the offending port BUT lsof AND netstat both do not reveal the port as being open.
    – jnman
    Jun 14, 2009 at 5:48
  • the port is 5631 which according to /etc/services is pcanywheredata so very suspicious.
    – jnman
    Jun 14, 2009 at 5:51
  • Now, that's nice, i didn't know that! Always used netstat. Thanks
    – buster
    Jun 14, 2009 at 12:07
  • 4
    If neither netstat nor lsof show the port as being used, but the machine is responding to it, chances are there's been a root kit installed. I recommend moving any data off the machine somewhere else and then nuking it. Jun 14, 2009 at 17:23
  • 6
    This is indeed a rootkit. I have seen this behavior before, and it is always a rootkit. Your system is compromised, and any tools you are using cannot be trusted. Boot into a Live CD (which has read-only trusted binaries) and use that to extract your data, settings, etc. Any programs you had, any scripts you had, abandon them. Do not bring them. Treat the system as if it has leprosy, because it /does/. Once you're done, nuke it from orbit. Do this as soon as possible. Oh, and unplug your network connection - deny your attacker access. Jun 14, 2009 at 20:39
23

Warning: Your system is compromised.

The tool you need is lsof, which will list files (and sockets and ports). It is most likely installed, and it is most likely the attacker's version, which means it will lie to you.

This is indeed a rootkit. I have seen this behavior before, and it is always a rootkit. Your system is compromised, and any tools you are using that originate from the same machine cannot be trusted. Boot into a Live CD (which has read-only trusted binaries) and use that to extract your data, settings, etc. Any programs you had, any scripts you had, abandon them. Do not bring them. Treat them, and the system, as if they have leprosy, because they do.

Once you're done, nuke it from orbit.

Game over man, game over.

Do this as soon as possible. Oh, and unplug your network connection - deny your attacker access.

6
  • 1
    This says it all really. Figure out what went wrong, flatten the server, restore from last known good backup. Life's too short to play games.
    – Rob Moir
    Jun 14, 2009 at 20:49
  • 2
    Just adding: be sure you know of the date of the break-in, as you may be restoring the same rootkit that you just removed. Otherwise, yeah, restore from /before/ that date. Jun 14, 2009 at 20:54
  • 1
    That's a funny graphic. I know the system is compromised (thankfully it's not mine). The question I was more curious about was tracking down how he got in in the first place. I suspect via php/joomla but wanted to understand how/why this port was staying open when none of the root kit detection tools were showing that port.
    – jnman
    Jun 14, 2009 at 23:34
  • 1
    lol @ "Oh, and unplug your network connection" Jun 15, 2009 at 11:40
  • 8
    Before you jump to that conclusion, there are other possible explanations for unexpected ports being open; such as a package you installed but forgot about.
    – David J.
    Nov 23, 2013 at 16:11
14
sudo netstat -lnp  

Lists ports that are listening for incoming connections and the associated process that has the port open.

4

netstat -anp

The "-p" tells it to list the process-ID that has the port open. The -an tells it to list listening ports and don't resolve names. On busy systems that can greatly speed up how fast it returns.

netstat -anp | grep "LIST"

That'll just give you the open ports.

4

If you can't see the port open with operating system tools and you suspect an intrussion it could be that a rootkit has been installed.

The rootkit could have changed systems tools to avoid certain processes and ports or changed kernel modules.

You can check for rootkit with several automated tools. 'apt-cache search rootkit' shows the following in Ubuntu:

chkrootkit - rootkit detector
rkhunter - rootkit, backdoor, sniffer and exploit scanner
unhide - Forensic tool to find hidden processes and ports

If you happen to have a rootkit you can revert the 'changed' to your system but I recommend that you find out how the intrussion was made and harden the system for it not to repeat.


They are not exclusive to Ubuntu, you can use them in CentOS too. Just look for the package or download it from their page.


By the output from that port it seems you're running pcanywhere indeed: "�Ы� <Enter>" is very similar to "Please press <Enter>" which is pcanywhere welcome message. I don't know why the process doesn't show up in the process list. Are you root?

You can try rebooting to see if it's a one time process running, as well.

4
  • any suggestions for centos?
    – jnman
    Jun 14, 2009 at 7:14
  • strangely, unhide-tcp does not show any suspicious ports. chkrootkit/rkhunter reported all clear (but mostly because i deleted the suspicious dirs prior to asking this question)
    – jnman
    Jun 14, 2009 at 8:37
  • FWIW, the rootkit had installed itself as apache in /var/tmp/... and /var/tmp/.ICE-Unix/* The second one was sneaky since I did not notice it the first time around and I was wondering how the heck a bash process kept spawning itself after being killed.
    – jnman
    Jun 14, 2009 at 23:36
  • Turns out the cracker installed a cron job.
    – jnman
    Jun 14, 2009 at 23:37
0

To expound on the answer by @bjtitus you can get some very detailed info, for example:

$ lsof -i :8000
COMMAND  PID  USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
squid3  1289 proxy   15u  IPv6 14810490      0t0  TCP *:8000 (LISTEN)

$ ps -fp 1289
UID        PID  PPID  C STIME TTY          TIME CMD
proxy     1289     1  0 09:48 ?        00:00:00 /usr/sbin/squid3 -N -f /etc/squid-deb-proxy/squid-deb-proxy.conf

I can see right there that squid is the process, but it is actualy my squid-deb-proxy that is taking up the port.

Another good example of a java app:

$ lsof -i :4242
COMMAND  PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
java    3075 root   86u  IPv4    12019      0t0  TCP *:4242 (LISTEN)

$ ps -fp 3075
UID        PID  PPID  C STIME TTY          TIME CMD
root      3075     1 15 May24 ?        3-16:07:25 /usr/local/crashplan/jre/bin/java -Dfile.encoding=UTF-8 -Dapp=CrashPlanService -DappBaseName=CrashPl

You can see in lsof (LiSt Open Files) that it is java, which is less than helpful. Running the ps command with the PID we can see right away that it is CrashPlan.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .