|
|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
![]() |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
|
#1
|
|||
|
|||
|
Hi,
I was scanning open ports in my PC (uses Windows XP) , and I found that Port 139 is open ( I guess it's the NetBIOS port ), So I made a little VB program, and connected to my PC through the port successfully using that program, My question is will I be able to hack my computer using that port ?? Even though I don't have any network connections or shared files except my High-Speed internet connection. |
|
#2
|
|||
|
|||
|
Port 139 NetBIOS
NetBIOS Session (TCP), Windows File and Printer Sharing This is the single most dangerous port on the Internet. All "File and Printer Sharing" on a Windows machine runs over this port. About 10% of all users on the Internet leave their hard disks exposed on this port. This is the first port hackers want to connect to, and the port that firewalls block. _________________________________________ Enter ye in at the strait gate: for wide is the gate, and broad is the way, that leadeth to destruction, and many there be which go in thereat Mat 7:13 |
|
#3
|
|||
|
|||
|
Thanks RolandG, But on my PC I don't have the "File and Printer Sharing" service enabled, I don't even have the NetBIOS protcol ,I try sending the "Get c:\somefile" command but my PC closes the connection, What does that mean ?? and If there is any other commands I can send to my PC to hack it please tell us about them
Thank you again |
|
#4
|
|||
|
|||
|
Try using fport it will let you know which program is binding to port 139.
http://www.foundstone.com fport.exe is able link the port to pid to program name in one command line program. See sample output below c:\fport Pid Process Port Proto Path 392 svchost -> 135 TCP C:\WINNT\system32\svchost.exe 8 System -> 139 TCP 8 System -> 445 TCP 508 MSTask -> 1025 TCP C:\WINNT\system32\MSTask.exe 392 svchost -> 135 UDP C:\WINNT\system32\svchost.exe 8 System -> 137 UDP 8 System -> 138 UDP 8 System -> 445 UDP 224 lsass -> 500 UDP C:\WINNT\system32\lsass.exe 212 services -> 1026 UDP C:\WINNT\system32\services.exe ____________________________________________ The way of a fool is right in his own eyes: but he that hearkeneth unto counsel is wise. Pro 12:15 |
|
#5
|
|||
|
|||
|
RonaldG, Thanks but I couldn't find the FPort..
CPORT says that the "system" uses this process... Process name: System Process ID: 4 Process Path: N/A File Name: N/A Protocol: TCP Local Port Name: netbios-ssn Local Address: XXX.XXX.12.67 <<-My IP Address Remote Address: 0.0.0.0 State: Listening Is it Windows XP that's using this process ?? If yes, What program or service in XP uses this port ?? and How dangerous can it be?? Thanks in advance |
|
#6
|
|||
|
|||
|
Here is the download link for fport,
http://www.foundstone.com/resources/freetools/fport.zip Who knows what it is, you have to link the port to the program file name and then verify that the program file is authentic. If you have a feeling that your machine is hacked you should also consider reinstalling the OS. After you reinstall the machine, don't enable Netbios / file sharing then check to see if port 139 is active. If port 139 is still active you probably have nothing to worry about but you can still contact the Microsoft support line to verify. |
|
#7
|
|||
|
|||
|
do you know of any programs like this one for linux???
|
|
#8
|
|||
|
|||
|
nm, found out that "netstat -pan" did that
![]() |
|
#9
|
|||
|
|||
|
Those netstat options only work on new versions of Windows (like XP). besides I think that you were refering to the "-o" option.
Finally my 100th and final post, take care all! ![]() Last edited by RolandG : August 29th, 2004 at 05:41 PM. |
![]() |
| Viewing: Dev Shed Forums > System Administration > Security and Cryptography > Can port ::139:: be dangerous ?! |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
|