September 18, 2008 at 7:47 pm #2853scucciParticipant
Currently we have a system open on our CheckPoint firewall that enables all traffic from the outside (i know this is horrible, and I’m trying to have this fixed). But I saw in our logs today that it was accessed via port 139 multiple times. I know this is a NetBios port and I’m concerned. I can’t think of any legitimate reason to have a machine connect to that port from the outside world.
My question is, where should I start looking to see if this machine was compromised? Are there any tools that can be run? Logs that I should look at? Any advice would be of great help.
September 18, 2008 at 8:18 pm #19852AnonymousParticipant
Netstat -an will give you connections established, hopefully nothing from the outside :'(
procexp.exe will give you a list of running processes, check out extraneous or if you have been done over they could using a system process to cloak there access.
What about another question, do you need netbios on your network, can you close this and other ports, is this in the DMZ, if it is close everything you can to reduce your attack vectors:
Port 139 (TCP) and Port 137 (UDP)
This is closed by following the following procedure:
• Right click My Network Places
• Select properties
• Double-click Local area connection
• Click Properties
• Double click TCP/IP Connections
• Click advanced
• Click WINS
• Tick disable NetBIOS over TCP/IP
For extra security, you should also deselect file and printer sharing on the Local area connection main page, general tab
Port 445 can be disabled on the host by using the following instructions :
• Select Start
• Select Run
• Type in Regedt32
• Locate the following key in the registry:
• Double-click on the key TransportBindName.
• Delete the value (Device), and leave the box blank.
• Close the Registry Editor
• Reboot your computer.
TCP Port 445 is now closed. This can be confirmed on the localhost by running the netstat command
Port 135 (TCP)
RPC services can’t be disabled but the parameters referencing the listening interfaces can be modified to bind this port to the localhost (127.0.0.1) and thus disallow access from external connections :
• Create a registry key file with the following contents:
Windows Registry Editor Version 5.00
• Save as 135.reg
• Double-click 135.reg
The keys are now written to the registry.
By default RPC listens on all network interfaces, this can be modified by creating the following Registry key and string (ListenOnInternet REG_SZ = N
) at the following location:
When this value is set to N (NO) the port 135 is listening only on interfaces listed in the value “Bind”=1 which correspond to 127.0.0.1 the localhost.
(or MS TCP Loopback interface)
This is achieved by setting the following string (EnableDCOM Reg_Sz = N) in the registry key:
Reboot the machine.
Port 135 is now bound to localhost. This can be confirmed on the localhost by running the netstat command
Just locked down a 2K3 server with this and lots of other tweaks you really need to assess what you actually need open and what services you need to run.
Hope this helps
- You must be logged in to reply to this topic.