Port 1116, or ardus-cntl

[ulysse]

I was netstating the school's server the other day.
onlt 2 ports i foud open were 136 and 1116

I was wondering what does 1116 does. I did a quick search on google, and found that it was the ardus-cntl command or something like this.

Can anyone enlight me a little ?

[bad_brain]

almost impossible to say because 1116 is not an assigned port (only ports up to 1024 are)...so in theory it could be anything. tried to telnet to that port already?
I doubt it's really ardus, because else 1115 would be open too...

[DNR]

Also try another scanner, some scanners 'guess' at the purpose of an open port. Some also false alarm on a port - claiming that the port is open when it actually just received an unexpected response.

Using another scanner can verify ports and services running.
You can also scan the network at another time, and you might find other ports open, maybe not even the same ones that were open before.

Try not to repeatedly scan the same network, if your IP keeps coming up and loading up the logs with scans, the sysadmin could take this as a pretext to an attack. If the ISP identifies you and the school matches your name in the student db, you are expelled for sure.

Identify the server OS, that will help you tailor your scans, no use scanning for nix ports when you know its a MS IIs server. Also identifying the OS can help suggest what ports may be running as its particular to that OS.
Beware that daemon banners can be faked.

Go play with a network overseas, at least they'll have a hard time trying to stop you.

DNR

[ulysse]

Well i was actually using the command prompt to netstat it because i didn't want to draw too much attention in my computer class while the teacher was struggling on teaching us on how to add a comment box to a text in MS Word
But what is ardus anyway? I couldn't find that on google in a one hour class. And i'm about 95% sure that school's server is on a Windows 2003 server. Should i telnet it?

[Gogeta70]

Use an anonymous proxy.

[DNR]

remember what B_B said, it could be anything, any software is allowed to use that port, not just ardus.

He said to Telnet to that port, to see if you can grep a banner,

220 gnr.u2me.com ESMTP Sendmail 8.9.3/8.9.3; Mon, 19 Dec 2007 01:45:38 -0500

The banner could be helpful in identifying what its for.

Last word of warning - hacking from inside a network is all to easy to bust you. Timestamps in the log can point to what class was in that room, when the computer was used improperly. If you did it once, you got lucky, do it again, esp. from the same room/computer - you failed as a hacker.

DNR

[ulysse]

Last word of warning - hacking from inside a network is all to easy to bust you. Timestamps in the log can point to what class was in that room, when the computer was used improperly. If you did it once, you got lucky, do it again, esp. from the same room/computer - you failed as a hacker.

DNR

I didn't, my main objective was somehow to be able to install winrar on their server, because 3/4 of school work i upload is in .rar file. Then i just got a easier idea: Portable winrar . Has been working perfectly since and the server admin doesn't suspect a thing. Thanks for the advices tho.