I ran nmap on my server and found a strange port open. I'm trying to figure out if there is a way to map that port to a specific process but have no idea if there is such a tool.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
As well as Netstat, mentioned in other posts, the lsof command should be able to do this just fine. Just use this:
lsof -i :<port number>
and all of the processes should come up. I use it on OS X quite frequently.
The tool you need is
lsof, which will list files (and sockets and ports). It is most likely installed, and it is most likely the attacker's version, which means it will lie to you.
This is indeed a rootkit. I have seen this behavior before, and it is always a rootkit. Your system is compromised, and any tools you are using that originate from the same machine cannot be trusted. Boot into a Live CD (which has read-only trusted binaries) and use that to extract your data, settings, etc. Any programs you had, any scripts you had, abandon them. Do not bring them. Treat them, and the system, as if they have leprosy, because they do.
Do this as soon as possible. Oh, and unplug your network connection - deny your attacker access.
If you can't see the port open with operating system tools and you suspect an intrussion it could be that a rootkit has been installed.
The rootkit could have changed systems tools to avoid certain processes and ports or changed kernel modules.
You can check for rootkit with several automated tools. 'apt-cache search rootkit' shows the following in Ubuntu:
chkrootkit - rootkit detector rkhunter - rootkit, backdoor, sniffer and exploit scanner unhide - Forensic tool to find hidden processes and ports
If you happen to have a rootkit you can revert the 'changed' to your system but I recommend that you find out how the intrussion was made and harden the system for it not to repeat.
They are not exclusive to Ubuntu, you can use them in CentOS too. Just look for the package or download it from their page.
By the output from that port it seems you're running pcanywhere indeed: "�Ы� <Enter>" is very similar to "Please press <Enter>" which is pcanywhere welcome message. I don't know why the process doesn't show up in the process list. Are you root?
You can try rebooting to see if it's a one time process running, as well.
To expound on the answer by @bjtitus you can get some very detailed info, for example:
$ lsof -i :8000 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME squid3 1289 proxy 15u IPv6 14810490 0t0 TCP *:8000 (LISTEN) $ ps -fp 1289 UID PID PPID C STIME TTY TIME CMD proxy 1289 1 0 09:48 ? 00:00:00 /usr/sbin/squid3 -N -f /etc/squid-deb-proxy/squid-deb-proxy.conf
I can see right there that squid is the process, but it is actualy my
squid-deb-proxy that is taking up the port.
Another good example of a java app:
$ lsof -i :4242 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME java 3075 root 86u IPv4 12019 0t0 TCP *:4242 (LISTEN) $ ps -fp 3075 UID PID PPID C STIME TTY TIME CMD root 3075 1 15 May24 ? 3-16:07:25 /usr/local/crashplan/jre/bin/java -Dfile.encoding=UTF-8 -Dapp=CrashPlanService -DappBaseName=CrashPl
You can see in
lsof (LiSt Open Files) that it is java, which is less than helpful. Running the
ps command with the PID we can see right away that it is CrashPlan.