http://www.hackerschool.org/HS_Boards/zboard.php?id=Free_Lectures&no=768 [º¹»ç]
ã¾Æº¸´Ï..2ÆäÀÌÁö¿¡ ÀÌ °Ô½Ã¹°ÀÌ ÀÖ´õ±º¿ä .. ±×·±µ¥ ¸®Çÿ¡ ±Ã±ÝÇØÇÏ´Â »ç¶÷ÀÌ ¸îºÐ °è¼¼ ´Ù½Ã ¿Ã·Áº¾´Ï´Ù..
ÇØÅ·ÅøÀº ÀϹÝÀûÀ¸·Î °ÔÀÓ ÆÐÄ¡³ª ½Ã½ºÅÛ À¯Æ¿¸®Æ¼·Î À§ÀåÇÏ¿© ¿Í·¹Áî »çÀÌÆ®, äÆÃ,
p2p°øÀ¯ ÇÁ·Î±×·¥,À̸ÞÀϵîÀ» ÅëÇØ ÀüÆĵǸç ÀÚ½ÅÀÌ ÇØÅ·Åø¿¡ °¨¿°µÇ¾ú´Ù´Â »ç½ÇÁ¶Â÷ ¸ð¸£´Â °æ¿ì°¡
ºÎÁö±â¼öÀÌ´Ù.
µû¶ó¼ ´ÙÀ½°ú °°Àº Áõ»óÀÌ ¹ß»ýÇÑ´Ù¸é ÇØÅ·Åø¿¡ ´ëÇÑ °¨¿°À» ÀǽÉÇØ º¼ ÇÊ¿ä°¡ ÀÖ´Ù.
- ½Ã½ºÅÛÀ» ºÎÆÃÇÒ ¶§ Æò»ó½Ã¿¡ Ãâ·ÂµÇÁö ¾Ê¾Ò´ø ¿¡·¯µéÀÌ Ãâ·ÂµÇ´Â °æ¿ì.
- ½Ã½ºÅÛÀÌ ÀÌÀ¯ ¾øÀÌ ÀçºÎÆÃÁ¾·áµÇ°í ÆÄÀϵéÀÌ »èÁ¦µÇ´Â °æ¿ì.
- ½ÇÇà ÁßÀÎ ÇÁ·Î±×·¥ÀÌ Á¾·áµÇ´Â °æ¿ì.
- »çÀÌÆ® ¹«´Ü °¡ÀÔ ¹× »ç¿ëÇÏÁö ¾ÊÀº À¯·á ÄÁÅÙÃ÷ ÀÌ¿ë¿¡ ´ëÇÑ ¿ä±Ý û±¸¼¸¦ ¹Þ¾ÒÀ» °æ¿ì.
- °ÔÀÓ ¾ÆÀÌÅÛÀ» ºÐ½ÇÇÑ °æ¿ì.
- º¸¾È ÇÁ·Î±×·¥µé¿¡¼ ÀÚÁÖ °æ°íâÀ» ¶ç¿ï °æ¿ì.(°æ¿ì¿¡ µû¶ó ´Ü¼øÇÑ °æ°íâÀÏ ¼ö ÀÖÀ½)
ÀÌ·²°æ¿ì ¾Æ·¡ÀÇ ¹æ¹ýÀ¸·Î °£´ÜÇÏ°Ô ³» PC¸¦ Á¡°ËÇØ º¼ ¼ö ÀÖ´Ù.
½ÃÀÛ½ÇÇàcmd¸í·É ÇÁ·ÒÇÁƮâÀ» ¶ç¿î µÚ
netstat -¿É¼Ç (¿¹ netstat -a)À» ÀÔ·ÂÇÏ°í ¿£ÅÍÇϸé Áö±Ý ´©°¡ ³» PC¿¡ ¿¬°ÉµÇ¾î ÀÖ´ÂÁö°¡
³ªÅ¸³´Ù.
[Netstat ¸í·É¾î ¿É¼Çµé]
- a ¿¬°áµÈ ȤÀº ¿¬°áÀ» ±â´Ù¸®°í ÀÖ´Â ¸ðµç Æ÷Æ® »óÅ Ãâ·Â.
- n È£½ºÆ® À̸§ ´ë½Å IPÁÖ¼Ò·Î Ãâ·Â.
- p,s ÁÖ·Î ÇÔ²² »ç¿ëÇϴµ¥ ÇÁ·ÎÅäÄÝÀÇ »óÅÂÃâ·Â.
- ESTABLISHED ÇöÀç ¿¬°áµÇ¾î ÀÖ´Â »óÅÂ.
- LISTENING ¿¬°áÀ» À§ÇÏ¿© Á¢¼Ó´ë±â »óÅÂ
- TIME_WAIT ÀÌ¹Ì ÇØ´ç »çÀÌÆ®¿Í ¿¬°áÀÌ Á¾·áµÇ¾ú°Å³ª ´ÙÀ½¿¬°áÀ» À§ÇØ ´ë±â»óÅÂ.
- SYN_SENT Á¢¼ÓÇϱâ À§ÇØ ÆÐŶÀ» Àü¼ÛÇß´Ù´Â ¶æ
netstat À¯Æ¿¸®Æ¼¸¦ ¼ö½Ã·Î ½ÇÇà½ÃÄÑ ½Ã½ºÅÛÀ» Á¡°ËÇØ º¸ÀÚ. ¸¸¾à ¾Ë ¼ö ¾ø´Â Æ÷Æ®°¡ Àְųª
31337, 12345, 54321¹ø°ú °°ÀÌ Æ®·ÎÀÌ ¸ñ¸¶°¡ »ç¿ëÇÏ´Â Æ÷Æ®°¡ ¿·Á ÀÖÀ» ¶§´Â ÇØÅ· À§Çè¿¡ ´ëÇÑ
½Ã½ºÅÛ Á¡°ËÀÌ ÇÊ¿äÇÏ´Ù. ƯÈ÷ ¿·ÁÁø Æ÷Æ®·Î ƯÁ¤ IP°¡ Á¢¼ÓÇØ ÀÖ´Ù¸é ÀÌ´Â ½ÊÁßÆȱ¸ ½Ã½ºÅÛÀÌ
ÇØÅ· ´çÇÏ°í ÀÖ´Ù´Â °ÍÀ» ÀǹÌÇÑ´Ù.
´Ü netstat ¸í·É¾î´Â ÀÎÅͳݿ¡ ¿¬°áµÇ¾î ÀÖ´Â ¸ðµç ÇÁ·Î¼¼½º¸¦ Á¾·áÇÑ ÈÄ¿¡ »ç¿ëÇؾß
Á» ´õ Á¤È®ÇÑ Å½Áö°¡ °¡´ÉÇÏ´Ù.
//
ÀÌÁ¦ºÎÅÍ º¸Ã溻ÀÔ´Ï´Ù..
Port´Â Á¢¼Ó Æ÷Æ®ÀÌ°í..
LocalAddress´Â »ç¿ëÀÚÀÇ IPÁÖ¼ÒÀÌ°í..
Foreign Address´Â »ó´ë IPÁÖ¼ÒÀÌ°í..
State´Â ÇöÀç »óÅÂÀÔ´Ï´Ù.
State°¡ Lisen?À̸é Æ÷Æ®°¡ ¿·Á°¡ ´©±º°¡°¡ Á¢¼ÓÇϱ⸦ ±â´Ù¸®´Â ÁßÀÔ´Ï´Ù.
¸¸¾à ´ÔÀÌ À¥¼ÇÎÀ» ÇÏ°Ô µÈ´Ù¸é ±× ÁÖ¼Ò±îÁöµµ ³ª¿À°Ô µË´Ï´Ù.
¸ðµç Á¤º¸°¡ ´©±º°¡°¡ ÇØÅ·À» ÇÏ·Á°í Á¢¼Ó½Ãµµ¸¦ ÇÏ´Â°Ç ¾Æ´ÏÁö¿ä.. ^^;
ÇØÅ·À» ¸·À»·Á¸é ¹æȺ®À» ¼³Ä¡ÇÏ´Â°É ±ÇÇØ µå¸³´Ï´Ù.
ÇØÅ· ½Ãµµ¸¦ ÇÏ´Â°Ç ¿·ÁÀִ ƯÁ¤Æ÷Æ®·Î Á¢¼ÓÀ» Çؼ ÇÏ°Ô µÇ´Âµ¥..
¹æȺ®Àº Æ÷Æ®¸¦ ¸·¾Æ ¹ö¸³´Ï´Ù.
(°í±Þ ÇØÄ¿´Â ¹æȺ®µµ ¶Õ½À´Ï´Ù.. ^^)
¹ÙÀÌ·¯½ºµµ ÇØÅ·À» À§ÇÑ ¹ÙÀÌ·¯½º´Â Æ÷Æ®¸¦ ¿°Ô µË´Ï´Ù.
À̸¥¹Ù ¹éµµ¾î¶ó°í ÇÏÁö¿ä..
netstat -nap (¿·Á ÀÖ´Â ¸ðµç Æ÷Æ®)
#netstat -l ¶Ç´Â netstat -nap | grep LISTEN (LISTEN µÇ´Â ¸ðµç Æ÷Æ®)
#netstat -nap | grep ESTABLISHED | wc -l ( ¸ðµç ¼ºñ½º µ¿½Ã Á¢¼ÓÀÚ ¼ö)
#netstat -nap | grep :80 | grep ESTABLISHED | wc -l ( À¥ µ¿½Ã Á¢¼ÓÀÚ ¼ö)
Æ÷Æ®½ºÄµ ¸í·É¾î·Î È®ÀÎ ÇÏ´Â ¹æ¹ý
# TCP Æ÷Æ® È®ÀÎ ¹æ¹ý
nmap -sT -p 1-65535 localhost
# UDP Æ÷Æ® È®ÀÎ ¹æ¹ý
nmap -sU -p 1-65535 localhost
# ³×Æ®¿öÅ©¿¡ ¿¸° Æ÷Æ® È®ÀÎ
nmap -sX -p 22,53,110 211.239.111.*
lsof ¸í·É¾î·Î È®ÀÎ ¹æ¹ý
# ¸ðµç ³×Æ®¿öÅ© ¼ÒÄÏ È®ÀÎ
lsof -I
1. netstat : ÇöÀç ´Ô ÄÄÇ»ÅÍ¿Í ¿¬°áµÇ¾ú°Å³ª ¿¬°áµÉ ¸ñ·ÏÀ» ÇÁ·ÎÅäÄÝ°ú ÇÔ²² º¸¿©ÁÖ´Â µµ½º ¸í·É¾îÀÔ´Ï´Ù.
2. netstat -a : ÇöÀç ´ÔÄÄÅÍ¿Í ¿¬°áµÇ°Å³ª ¿¬°áµÉ ¸ñ·ÏÀ» ÇÁ·ÎÅäÄÝ°ú ÇÔ²² ¸ðµÎ º¸¿©ÁÝ´Ï´Ù. -a ¿É¼ÇÀÌ ¾øÀ¸¸é ¿¬°áµÈ ¸ñ·Ï¸¸ º¸¿©Áִµ¥, -a ¿É¼ÇÀ» ÁÖ¸é ¿¬°áµÇ¾ú°Å³ª ¿¬°áÀ» ±â´Ù¸®´Â ¸ñ·ÏÀ» ¸ðµÎ º¸¿©ÁÝ´Ï´Ù.
3. netstat -n : Åë»ó ¿¬°á ¸ñ·ÏÀÌ ÄÄÇ»ÅÍ À̸§ÀÌ ³ª¿À´Âµ¥, -n ¿É¼ÇÀ» ÁÖ¸é ÄÄÇ»ÅÍÀ̸§´ë½Å ipÁÖ¼Ò°¡ ¶å´Ï´Ù.
4. netstats -an or -na : µÑ´Ù °°Àº ÀǹÌÀε¥ ´Ô ÄÄÇ»ÅÍ¿Í ¿¬°áµÇ¾ú´ø ȤÀº ¿¬°áÀ» ±â´Ù¸®´Â ¸ñ·ÏÀ» ¾ÆÀÌÇÇÁÖ¼Ò·Î ¹Ù²Ù¾î¼ º¸¿©ÁÝ´Ï´Ù.
Command ¸ðµå¿¡¼ netstat¸¦ »ç¿ëÇÏ¿© PC³»ÀÇ ¾Ç¼º ÄÚµå ¿©ºÎ¸¦ È®ÀÎÇÒ ¼öµµ ÀÖ´Ù.
1. [½ÃÀÛ¹öÆ°] > [½ÇÇà]À» ´·¯¼ cmd ¶ó°í ÀÔ·ÂÇÏ¿© Command âÀ» ¶ç¿î´Ù.
<Âü°í: CTRL+R À» ´©¸£¸é [½ÇÇà]âÀÌ ¹Ù·Î ¶á´Ù.>
<¶Ç Âü°í: Windows 98¿¡¼´Â cmd °¡ ¾Æ´Ï¶ó command ¶ó°í ÇØ¾ß command âÀÌ ³ª¿Â´Ù.>
2. netstat -an
ÀÌ ¸í·É¾î¸¦ Ä¡¸é ¾Æ·¡ ±×¸²°ú °°Àº ¸Þ½ÃÁö°¡ Ãâ·ÂµÈ´Ù.
ÀÌ ¸í·É¾î¸¦ Ä¡¸é ¾Æ·¡ ±×¸²°ú °°Àº ¸Þ½ÃÁö°¡ Ãâ·ÂµÈ´Ù.
¾Õ¿¡ º¸ÀÌ´Â IPÁÖ¼Ò(Local Address)´Â ·ÎÄýýºÅÛ(³» PC)ÀÇ IPÁÖ¼ÒÀÌ¸ç µÚÀÇ IPÁÖ¼Ò(Foreign Address)´Â ³ª¿Í ³×Æ®¿öÅ©·Î ¿¬°áÀÌ ÀÌ·ç¾îÁø ½Ã½ºÅÛÀÇ IPÁÖ¼ÒÀÌ´Ù. (IPµÚÀÇ ":¼ýÀÚ" µéÀº Æ÷Æ® ¹øÈ£ÀÌ´Ù.)netstat ¸í·É¾î´Â ÇöÀç ½Ã½ºÅÛ°ú ³×Æ®¿öÅ©·Î ¿¬°áÀÌ ÀÌ·ç¾îÁø »óŸ¦ º¸¿©ÁÖ´Â ¸í·É¾î´Ù.
ÀÚ, ÀÌÁ¦ ºÐ¼® ¹æ¹ýÀÌ´Ù!(FPORT ºí·Î±×¿¡¼´Â Á¸´ñ¸»À» ½è¾ú´Âµ¥ ¿Ö °©Àڱ⠹ݸ»¾²³Ä°í ¿åÇÏÁö´Â ¸¶¼¼¿ä;)
¸ÕÀú À§ ¸Þ½ÃÁöÀÇ ¸Ç ³¡ ÇʵåÀÎ State Çʵ带 º¸ÀÚ. ESTABLISHED´Â ¿¬°áµÇ¾îÀÖ´Â »óŸ¦ ¸»Çϸç CLOSED´Â ÀÌ¹Ì ¿¬°áÀÌ ²÷¾îÁ³À½À» ¸»ÇÑ´Ù. LISTENINGÀº ÇöÀç ½Ã½ºÅÛ¿¡¼ ¿·ÁÀÖ´Â Æ÷Æ®¸¦ ¸»ÇÑ´Ù.
ÀÏ´Ü LISTENING À̶ó°í µÇ¾îÀÖ´Â ³ðµéÀº º»´Ù. IPÁÖ¼Ò´Â 0.0.0.0À¸·Î µÈ ³ðµéÀÌ ¸¹°í ³» IPÁÖ¼Ò ¸î°³ ¾ÈµÉ°ÍÀÌ´Ù.
<Âü°í: 0.0.0.0(³×Æ®¿öÅ© IP) - À̳ðÀ» ÀνÄÇÏÁö ¸øÇϸé ÀÎÅͳÝÀ» ¸øÇÑ´Ù.>
<¶Ç Âü°í: 127.0.0.1(LocalHost IP) - À̳ðÀº Àڱ⸦ ½º½º·Î °¡¸®Å³¶§ »ç¿ëÇÏ´Â ÁÖ¼ÒÀÌ´Ù.>
Local Address ÇʵåÀÇ IP´Â Áß¿äÇÏÁö ¾Ê´Ù. ¾îÂ÷ÇÇ °Å±â´Â ³» ÄÄÇ»ÅÍÀÇ Á¤º¸¸¸ ³ª¿À´Ï±î. Áß¿äÇÑ°ÍÀº LISTENINGÀ¸·Î µÇ¾îÀÖ´Â, ´Ù½Ã¸»Çϸé "¿·ÁÀÖ´Â Æ÷Æ®"¹øÈ£ÀÌ´Ù.
³» ÄÄÇ»ÅÍ¿¡ ¸î¹ø Æ÷Æ®µéÀÌ ¿·ÁÀÖ´ÂÁö »ìÆ캻 ÈÄ¿¡, ¸¸ÀÏ ±× Æ÷Æ®·Î Á¢¼ÓÇÑ ³ðÀÌ ÀÖ´Ù¸é 90%´Â ¹º°¡ ÀÌ»óÇÑ °Å¶ó°í »ý°¢ÇÏ¸é µÈ´Ù.
¿¹¸¦ µé¾î,
0.0.0.0:445 0.0.0.0:0 LISTENING
. . .
. . .
. . .
150.2.50.14:445 68.235.32.153:4461 ESTABLISHED
ÀÌ·¸°Ô º¸¿´´Ù°í ÇÏÀÚ, 445 ¹ø Æ÷Æ®(0.0.0.0:445)°¡ ÇöÀç ¿·Á(LISTENING)ÀÖÀ½À» ¾Ë ¼ö ÀÖ°í,
¾Æ·¡¿¡´Â ³» 445¹ø Æ÷Æ®·Î(150.2.50.14:445) À¢ 68.235.32.153 À̶ó´Â ³ðÀÌ Á¢¼Ó(ESTABLISHED)Çß´Ù´Â °ÍÀÌ È® µå·¯³µ´Ù.
ÀÏ¹Ý °³ÀÎ ÄÄÇ»ÅÍ À̹ǷΠ´©°¡ ³» ÄÄÇ»ÅÍ·Î µé¾î¿ÃÀÏÀº °ÅÀÇ ¾ø´Ù! (P2P·Î ³» ÄÄÇ»ÅÍÀÇ Æú´õ°¡ °øÀ¯µÇ¾î ÀÖ´Ù¸é ¸ô¶óµµ..)
¾Æ¹«Æ° ÀÌ·±½ÄÀ¸·Î ºÐ¼®À» ÇÏ¸é µÇ°Ú´Ù.
±× ¿ÜÀÇ °ÍµéÀº ÁË´Ù ³»°¡ »ó´ë¹æ ÄÄÇ»ÅÍ·Î Á¢¼ÓÇÑ°ÍÀ» ³ªÅ¸³»´Â °ÍÀ̱⠶§¹®¿¡ ¹«½ÃÇصµ µÈ´Ù. ¹°·Ð, Reverse ÇØÅ· ¹æ½ÄÀÌ ÀÖ±â´Â ÇÏÁö¸¸, ±×°É °³ÀÎ ÄÄÇ»ÅÍ¿¡ Àû¿ëÇÒ Á¤µµ·Î ¹«½ÄÇÑ Å©·¡Ä¿´Â ¾øÀ»°ÍÀÌ´Ù.
netstat ¸í·É¾î¸¦ Ä¡½Ã¸é foreign address ¶ó´Â °Ô ÀÖÁÒ.
±× °÷¿¡ ¾ÆÀÌÇÇ : ¼ýÀÚ
ÀÏÄÉ ½áÀÖÀݾƿä..
¿©±â¼ ¼ýÀÚ´Â Æ÷Æ®¶ó´Â°Í ÀÔ´Ï´Ù.
ÄÄÇ»ÅÍÀÇ ¿·ÁÀִ â¹®À̶ó°í »ý°¢ÇÏ¸é µÇÁÒ.
Æ®·ÎÀ̸ñ¸¶ ÇÁ·Î±×·¥ÀÌ Ä§ÅõÇÏ·Á¸é ±× ÇÁ·Î±×·¥ÀÌ Ä§ÅõÇÒ¼ö ÀÖ´Â °íÀ¯ÀÇ Ã¢¹® ,Áï Æ÷Æ®°¡ ¿·ÁÀÖ¾î¾ß ÇÕ´Ï´Ù.
¼¹öÆÄÀÏÀ̶õ°Ô Àִµ¥ ±× ÇÁ·Î±×·¥ÀÌ Ä§ÅõÇÒ¼öÀÖ´Â Æ÷Æ®¸¦ ¿©´Â ¿ªÇÒÀ» ÇÏÁÒ.
¿©±â¼ ¾Æ±î netstat ¸í·É¾î Ä¡¸é ³ª¿À´Â°Å..
¾ÆÀÌÇÇ:¼ýÀÚ ÀÖÀݾƿä.
¸¸¾à¿¡
211.111.111.111 :12345
ÀÌ·¸°Ô µÆÀ¸¸é 12345¶ó´Â Æ÷Æ®¿¡ 211.111.111.111 À̶ó´Â ¾ÆÀÌÇÇ°¡ Á¢¼ÓÇØÀÖ´Ù´Â °Ì´Ï´Ù.
12345¶ó´Â Æ÷Æ®´Â ³Ý¹ö½º 1.70°¡ ħÅõÇÒ¼ö ÀÖ´Â Æ÷Æ®¹øÈ£ÁÒ...
Á¦°¡ ¿©·¯ Æ®·ÎÀ̸ñ¸¶ ÇÁ·Î±×·¥ÀÌ Ä§ÅõÇÏ´Â Æ÷Æ®¹øÈ£µéÀ» ¸ð¾ÆºÃ½À´Ï´Ù.ÇØÄ¿´º½º¿¡¼ Æß
port 2 - Death
port 21 - Back Construction, Blade Runner, Doly Trojan, Fore, FTP trojan, Invisible FTP, Larva, MBT, Motiv, Net Administrator, Senna Spy FTP Server, WebEx, WinCrash
port 23 - Tiny Telnet Server, Truva Atl
port 25 - Aji, Antigen, Email Password Sender, Gip, Happy 99, I Love You, Kuang 2, Magic Horse, Moscow Email Trojan, Naebi, NewApt, ProMail trojan, Shtrilitz, Stealth, Tapiras, Terminator, WinPC, WinSpy
port 31 - Agent 31, Hackers Paradise, Masters Paradise
port 41 - DeepThroat
port 48 - DRAT
port 50 - DRAT
port 59 - DMSetup
port 79 - Firehotcker
port 80 - Back End, Executor, Hooker, RingZero
port 99 - Hidden Port
port 110 - ProMail trojan
port 113 - Invisible Identd Deamon, Kazimas
port 119 - Happy 99
port 121 - JammerKillah
port 123 - Net Controller
port 133 - Farnaz, port 146 - Infector
port 146 (UDP) - Infector
port 170 - A-trojan
port 421 - TCP Wrappers
port 456 - Hackers Paradise
port 531 - Rasmin
port 555 - Ini-Killer, NeTAdministrator, Phase Zero, Stealth Spy
port 606 - Secret Service
port 666 - Attack FTP, Back Construction, NokNok, Cain & Abel, Satanz Backdoor, ServeU, Shadow Phyre
port 667 - SniperNet
port 669 - DP Trojan
port 692 - GayOL
port 777 - Aim Spy
port 808 - WinHole
port 911 - Dark Shadow
port 999 - DeepThroat, WinSatan
port 1000 - Der Spacher 3
port 1001 - Der Spacher 3, Le Guardien, Silencer, WebEx
port 1010 - Doly Trojan
port 1011 - Doly Trojan
port 1012 - Doly Trojan
port 1015 - Doly Trojan
port 1016 - Doly Trojan
port 1020 - Vampire
port 1024 - NetSpy
port 1042 - Bla
port 1045 - Rasmin
port 1050 - MiniCommand
port 1080 - WinHole
port 1081 - WinHole
port 1082 - WinHole
port 1083 - WinHole
port 1090 - Xtreme
port 1095 - RAT
port 1097 - RAT
port 1098 - RAT
port 1099 - BFevolution, RAT
port 1170 - Psyber Stream Server, Streaming Audio trojan, Voice
port 1200 (UDP) - NoBackO
port 1201 (UDP) - NoBackO
port 1207 - SoftWAR
port 1212 - Kaos
port 1225 - Scarab
port 1234 - Ultors Trojan
port 1243 - BackDoor-G, SubSeven, SubSeven Apocalypse, Tiles
port 1245 - VooDoo Doll
port 1255 - Scarab
port 1256 - Project nEXT
port 1269 - Mavericks Matrix
port 1313 - NETrojan
port 1338 - Millenium Worm
port 1349 (UDP) - BO DLL
port 1492 - FTP99CMP
port 1509 - Psyber Streaming Server
port 1524 - Trinoo
port 1600 - Shivka-Burka
port 1777 - Scarab
port 1807 - SpySender
port 1966 - Fake FTP
port 1969 - OpC BO
port 1981 - Shockrave
port 1999 - BackDoor, TransScout
port 2000 - Der Spaeher 3, Insane Network, TransScout
port 2001 - Der Spaeher 3, TransScout, Trojan Cow
port 2002 - TransScout
port 2003 - TransScout
port 2004 - TransScout
port 2005 - TransScout
port 2023 - Ripper
port 2080 - WinHole
port 2115 - Bugs
port 2140 - Deep Throat, The Invasor
port 2155 - Illusion Mailer
port 2283 - HVL Rat5
port 2300 - Xplorer
port 2565 - Striker
port 2583 - WinCrash
port 2600 - Digital RootBeer
port 2716 - The Prayer
port 2773 - SubSeven
port 2801 - Phineas Phucker
port 3000 - Remote Shutdown
port 3024 - WinCrash
port 3128 - RingZero
port 3129 - Masters Paradise
port 3150 - Deep Throat, The Invasor
port 3456 - Teror Trojan
port 3459 - Eclipse 2000, Sanctuary
port 3700 - Portal of Doom
port 3791 - Eclypse
port 3801 (UDP) - Eclypse
port 4000 - Skydance
port 4092 - WinCrash
port 4242 - Virtual hacking Machine
port 4321 - BoBo
port 4444 - Prosiak, Swift remote
port 4567 - File Nail
port 4590 - ICQTrojan
port 5000 - Bubbel, Back Door Setup, Sockets de Troie
port 5001 - Back Door Setup, Sockets de Troie
port 5010 - Solo
port 5011 - One of the Last Trojans (OOTLT)
port 5031 - NetMetropolitan
port 5031 - NetMetropolitan
port 5321 - Firehotcker
port 5343 - wCrat
port 5400 - Blade Runner, Back Construction
port 5401 - Blade Runner, Back Construction
port 5402 - Blade Runner, Back Construction
port 5550 - Xtcp
port 5512 - Illusion Mailer
port 5555 - ServeMe
port 5556 - BO Facil
port 5557 - BO Facil
port 5569 - Robo-Hack
port 5637 - PC Crasher
port 5638 - PC Crasher
port 5742 - WinCrash
port 5882 (UDP) - Y3K RAT
port 5888 - Y3K RAT
port 6000 - The Thing
port 6006 - The Thing
port 6272 - Secret Service
port 6400 - The Thing
port 6667 - Schedule Agent
port 6669 - Host Control, Vampyre
port 6670 - DeepThroat, BackWeb Server, WinNuke eXtreame
port 6711 - SubSeven
port 6712 - Funny Trojan, SubSeven
port 6713 - SubSeven
port 6723 - Mstream
port 6771 - DeepThroat
port 6776 - 2000 Cracks, BackDoor-G, SubSeven
port 6838 (UDP) - Mstream
port 6912 - Shit Heep (not port 69123!)
port 6939 - Indoctrination
port 6969 - GateCrasher, Priority, IRC 3, NetController
port 6970 - GateCrasher
port 7000 - Remote Grab, Kazimas, SubSeven
port 7001 - Freak88
port 7215 - SubSeven
port 7300 - NetMonitor
port 7301 - NetMonitor
port 7306 - NetMonitor
port 7307 - NetMonitor
port 7308 - NetMonitor
port 7424 - Host Control
port 7424 (UDP) - Host Control
port 7789 - Back Door Setup, ICKiller
port 7983 - Mstream
port 8080 - RingZero
port 8787 - Back Orifice 2000
port 8897 - HackOffice
port 8988 - BacHack
port 8989 - Rcon
port 9000 - Netministrator
port 9325 (UDP) - Mstream
port 9400 - InCommand
port 9872 - Portal of Doom
port 9873 - Portal of Doom
port 9874 - Portal of Doom
port 9875 - Portal of Doom
port 9876 - Cyber Attacker, RUX
port 9878 - TransScout
port 9989 - iNi-Killer
port 9999 - The Prayer
port 10067 (UDP) - Portal of Doom
port 10085 - Syphillis
port 10086 - Syphillis
port 10101 - BrainSpy
port 10167 (UDP) - Portal of Doom
port 10528 - Host Control
port 10520 - Acid Shivers
port 10607 - Coma
port 10666 (UDP) - Ambush
port 11000 - Senna Spy
port 11050 - Host Control
port 11051 - Host Control
port 11223 - Progenic trojan, Secret Agent
port 12076 - Gjamer
port 12223 - Hack¢¥99 KeyLogger
port 12345 - GabanBus, My Pics, NetBus, Pie Bill Gates, Whack Job, X-bill
port 12346 - GabanBus, NetBus, X-bill
port 12349 - BioNet
port 12361 - Whack-a-mole
port 12362 - Whack-a-mole
port 12623 (UDP) - DUN Control
port 12624 - Buttman
port 12631 - WhackJob
port 12754 - Mstream
port 13000 - Senna Spy
port 13010 - Hacker Brazil
port 15092 - Host Control
port 15104 - Mstream
port 16660 - Stacheldracht
port 16484 - Mosucker
port 16772 - ICQ Revenge
port 16969 - Priority
port 17166 - Mosaic
port 17300 - Kuang2 The Virus
port 17777 - Nephron
port 18753 (UDP) - Shaft
port 19864 - ICQ Revenge
port 20001 - Millennium
port 20002 - AcidkoR
port 20034 - NetBus 2 Pro, NetRex, Whack Job
port 20203 - Chupacabra
port 20331 - Bla
port 20432 - Shaft
port 20432 (UDP) - Shaft
port 21544 - GirlFriend, Kidterror, Schwindler, WinSp00fer
port 22222 - Prosiak
port 23023 - Logged
port 23432 - Asylum
port 23456 - Evil FTP, Ugly FTP, Whack Job
port 23476 - Donald Dick
port 23476 (UDP) - Donald Dick
port 23477 - Donald Dick
port 26274 (UDP) - Delta Source
port 26681 - Spy Voice
port 27374 - SubSeven
port 27444 (UDP) - Trinoo
port 27573 - SubSeven
port 27665 - Trinoo
port 29104 - Host Control
port 29891 (UDP) - The Unexplained
port 30001 - TerrOr32
port 30029 - AOL Trojan
port 30100 - NetSphere
port 30101 - NetSphere
port 30102 - NetSphere
port 30103 - NetSphere
port 30103 (UDP) - NetSphere
port 30133 - NetSphere
port 30303 - Sockets de Troie
port 30947 - Intruse
port 30999 - Kuang2
port 31335 (UDP) - Trinoo
port 31336 - Bo Whack, ButtFunnel
port 31337 - Baron Night, BO client, BO2, Bo Facil
port 31337 (UDP) - BackFire, Back Orifice, DeepBO, Freak>
port 31338 - NetSpy DK, ButtFunnel
port 31338 (UDP) - Back Orifice, DeepBO
port 31339 - NetSpy DK
port 31666 - BOWhack
port 31785 - Hack¢¥a¢¥Tack
port 31787 - Hack¢¥a¢¥Tack
port 31788 - Hack¢¥a¢¥Tack
port 31789 (UDP) - Hack¢¥a¢¥Tack
port 31791 (UDP) - Hack¢¥a¢¥Tack
port 31792 - Hack¢¥a¢¥Tack
port 32100 - Peanut Brittle, Project nEXT
port 32418 - Acid Battery
port 33333 - Blakharaz, Prosiak
port 33577 - PsychWard
port 33777 - PsychWard
port 33911 - Spirit 2001a
port 34324 - BigGluck, TN
port 34555 (UDP) - Trinoo (Windows)
port 35555 (UDP) - Trinoo (Windows)
port 37651 - YAT
port 40412 - The Spy
port 40421 - Agent 40421, Masters Paradise
port 40422 - Masters Paradise
port 40423 - Masters Paradise
port 40426 - Masters Paradise
port 41666 - Remote Boot
port 41666 (UDP) - Remote Boot
port 44444 - Prosiak
port 47262 (UDP) - Delta Source
port 50505 - Sockets de Troie
port 50766 - Fore, Schwindler
port 51996 - Cafeini
port 52317 - Acid Battery 2000
port 53001 - Remote Windows Shutdown
port 54283 - SubSeven
port 54320 - Back Orifice 2000
port 54321 - School Bus
port 54321 (UDP) - Back Orifice 2000
port 57341 - NetRaider
port 58339 - ButtFunnel
port 60000 - Deep Throat
port 60068 - Xzip 6000068
port 60411 - Connection
port 61348 - Bunker-Hill
port 61466 - Telecommando
port 61603 - Bunker-Hill
port 63485 - Bunker-Hill
port 65000 - Devil, Stacheldracht
port 65432 - The Traitor
port 65432 (UDP) - The Traitor
port 65535 - RC
ÀÌ·¸°Ô ÀÖ½À´Ï´Ù.
ÀÌ°É º½À¸·Î¼ ¹«½¼ ÇÁ·Î±×·¥À» »ç¿ëÇÏ¿© ÄÄÀ» °ø°ÝÇß´ÂÁö ¾Ë¼ö ÀÖ½À´Ï´Ù.
±×¸®°í ±×³É netstat ¸í·É¾î¸¦ »ç¿ëÇÏÁö ¸¶½Ã°í
netstat -an À̶ó´Â ¸í·ÉÀ» »ç¿ëÇؼ º¸½Ã±â ¹Ù¶ø´Ï´Ù.
netstat ¸í·É¾î·Î Àå¾Öó¸®
1. netstat -rn
netstat ¸í·ÉÀº ¶ó¿ìÆà Å×À̺íÀ» º¸¿©ÁֹǷΠ³×Æ®¿÷ »óŸ¦ È®ÀÎÇÒ ¼ö ÀÖÀ½.
(Âü°í: Cisco router: sh ip route, Extreme switch: sh iproute)
netstat -rn Àº ¶ó¿ìÆà Å×À̺íÀ» ¼öÄ¡·Î º¸¿©ÁÖ´Â °ÍÀ¸·Î ÀÌ·¸°Ô Çϸé À̸§ ã±â¸¦ ÇÏ´Â °Í º¸´Ù ºü¸£°í /etc/services, /etc/hosts ÆÄÀÏÀÌ Á¤È®ÇÏÁö ¾ÊÀ» ¶§ È¥µ¿À» ÇÇÇϱâ À§Çؼµµ »ç¿ëÇÒ ¼ö ÀÖÀ¸¸ç, ¶ÇÇÑ Á÷°üÀûÀ¸·Î IP ÁÖ¼Ò¸¦ È®ÀÎÇÒ ¼ö ÀÖ´Ù.
Flags¿¡¼ U´Â °æ·Î°¡ »ç¿ë °¡´ÉÇÑ »óÅÂ, H´Â ¸ñÀûÁö°¡ ³×Æ®¿÷ÀÌ ¾Æ´Ñ È£½ºÆ®À̸ç, G´Â °ÔÀÌÆ®¿þÀ̳ª ¶ó¿ìÅ͸¦ ÀǹÌÇÑ´Ù. ¶ÇÇÑ, ºê·ÎƮij½ºÆ® b, Á¤ÀûÀ¸·Î Ãß°¡µÈ Ç׸ñÀº S, º¹Á¦ÀÇ °á°ú·Î »ý¼ºµÈ °æ·ÎÀÓÀ» ³ªÅ¸³»´Â W¿Í cµîÀ» Æ÷ÇÔÇÑ´Ù.
sol:/bin% netstat -rn ; r Àº Routing TableÀ» ³ªÅ¸³»¸ç n Àº ÁÖ¼Ò¿Í Æ÷Æ®¸¦ ¼ýÀÚ·Î ³ªÅ¸³»ÁÜ.
Routing Table:
Destination Gateway Flags Ref Use Interface
-------------------- -------------------- ----- ----- ------ ---------
210.116.105.0 210.116.105.112 U 3 1306 hme0
10.107.11.0 10.107.11.112 U 2 685 hme1
10.107.0.0 10.107.11.254 UG 0 19334
224.0.0.0 210.116.105.112 U 3 0 hme0
default 210.116.105.126 UG 0 179635
127.0.0.1 127.0.0.1 UH 0 4414 lo0
2. netstat -an
netstatÀÇ ±â´É Çϳª´Â ÇÑ È£½ºÆ®¿¡¼ÀÇ ¿¬°á ³»¿ª(all connections)°ú ¼ºñ½ºÀÇ ¸ñ·Ï(listening ports)À» º¸¿©ÁÖ´Â °ÍÀÌ´Ù. (netstat ?a)
¹ÙÀÌ·¯½º, ¿ú À̳ª ÇØÅ·µîÀÇ »óŸ¦ È®ÀÎÇÒ ¼ö ÀÖ´Â ¼ö´ÜÀÌ µÉ ¼öµµ ÀÖ´Ù.
ListeningÀ̳ª Established µÈ SessionÀÇ IP ÁÖ¼Ò³ª Æ÷Æ®¸¦ È®ÀÎÇÑ´Ù.
http://www.ccgsecurity.com/port.asp
Pipe line°ú ÇÔ²² Unix/Linux´Â grep, Windows´Â find ¿É¼ÇÀ» º´ÇàÇÏ¿©, ƯÁ¤ Æ÷Æ®¸¦ °Ë»öÇÑ´Ù.
analysisman:/home/elca% netstat -an | grep 22
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 210.116.123.195:21 211.226.105.161:3044 ESTABLISHED
tcp 0 48 210.116.123.195:22 210.116.123.196:3619 ESTABLISHED
tcp 0 0 210.116.123.195:22 210.116.123.196:3618 ESTABLISHED
C:\>netstat -an | find "445"
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
UDP 0.0.0.0:445 *:*
3. netstat -i, netstat -e
netstat ?i (Unix/Linux), netstat ?e (Windows) ¿É¼ÇÀ» ÀÌ¿ëÇÏ¿© ÇØ´ç ÀÎÅÍÆäÀ̽ºÀÇ ÆÐŶ·®°ú ¿¡·¯, Collision µîÀ» È®ÀÎÇÒ ¼ö ÀÖ´Ù.
ƯÁ¤ ÇÁ·ÎÅäÄÝÀÇ ¿¬°á ÇöȲ ÆľÇÇϱâ
- Unix: netstat -P protocol (tcp/udp¡¦)
- Linux: netstat -tcp/-udp
- Windows: netstat -p protocol
* -s (statistics)¿É¼ÇÀ» °°ÀÌ »ç¿ëÇϸé ÇØ´ç ÇÁ·ÎÅäÄÝÀÇ Åë°èÄ¡¸¦ º¼ ¼ö ÀÖ´Ù.
C:\>netstat -s -p tcp
TCP Statistics
Active Opens = 204
Passive Opens = 734
Failed Connection Attempts = 2
Reset Connections = 263
Current Connections = 2
Segments Received = 44759
Segments Sent = 26058
Segments Retransmitted = 15
»ó±â ¿¹Á¦¸¦ º¸¸é 26,058 TCP ¼¼±×¸ÕÆ®°¡ ¼¹ö¿¡ ÀÇÇØ Àü¼ÛµÇ¾ú°í 15°³ÀÇ ÀçÀü¼Û(Retransmission)ÀÌ ¹ß»ýÇÏ¿´´Ù. ÀÌ°ÍÀº 1% º¸´Ù ÀÛ´Ù. ¸¸¾à, ÆÛ¼¾Æ®°¡ À̺¸´Ù ³ô¾ÆÁø´Ù¸é Analyzer¸¦ °É¾î¼ TCP Æ®·¡ÇÈÀ» Á¶»çÇØ¾ß ÇÑ´Ù
//
Àú ÀÌ°Å Æۿ°Ŷó..¸¾´ë·Î ÆÛ¿À¸é¾ÈµÇ°ÚÁö¸¸;; ¾î¶µç ÀߺÁÁÖ¼¼¿ä ..¤Ì¤Ìù°Ô½Ã±ÛÀÔ´Ï´Ù ¤¾¤¾;;
|
Hit : 51025 Date : 2007/08/03 09:09
|