Sunday, September 11, 2016

Its not SSH if its on port 55251

When I was first trying to figure out what the Sunpower monitoring ethernet device was (I had a device on my network I didn't know what it was) I did a port scan to try and figure it out.
>nmap sunpower-plc -p1-65535 -vvv
Starting Nmap 6.40 ( http://nmap.org ) at 2016-09-11 16:40 EDT
Initiating Ping Scan at 16:40
Scanning sunpower-plc [2 ports]
Completed Ping Scan at 16:40, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:40
Completed Parallel DNS resolution of 1 host. at 16:41, 6.50s elapsed
DNS resolution of 1 IPs took 6.50s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 3, CN: 0]
Initiating Connect Scan at 16:41
Scanning sunpower-plc [65535 ports]
Discovered open port 55251/tcp on sunpower-plc
Okay, so what is port 55251? 
telnet sunpower-plc 55251
Trying sunpower-plc...
Connected to sunpower-plc
Escape character is '^]'.
SSH-2.0-OpenSSH_6.6
When I didn't know what it was I was even more worried, who is running ssh on a non-standard port on my network anyhow?  A quick look at the vulnerabilities for this version of Openssh look fairly benign as of today and at least its encrypted.

No comments:

Post a Comment