I've been troubleshooting this same issue on a linux system, and I've written a few scripts (see attached) to aid in identifying problem ports. You might have to tweak them for solaris, but they're written in bash and python, so there hopefully shouldn't be too many differences.
The first script, bindport, just attempts to bind to a single port. You can see its usage by invoking it with no arguments. It binds to the port using TCP unless it's named bindudp (by symlinking to it, presumably) The second script, portseek, attempts to bind to every port between 0 and whatever the maximum is, and uses lsof to report any 'hidden' ports. This should more or less be the same as what OSSEC does. regards, -Nate > -----Original Message----- > From: Sebel, Gary M. [mailto:[email protected]] > Sent: Wednesday, February 16, 2011 2:15 PM > To: [email protected] > Subject: Re: [ossec-list] rootcheck on solaris issues > > Dan > > It is the same each run on the system. How do you check to > see if the port is open in solaris prior to doing the > netstat. I ask because I have had another person confirm > that they also see none of the ports reported as open. > > So from the runs on the 15th and the 16th the same set of > ports are open in the 600/700 range. I am trying to test this > out on another solaris server not running zones. > > Thanks > -gary > > On 2/16/11 2:53 PM, "dan (ddp)" <[email protected]> wrote: > > >Hi Gary, > >Is it always the same port? > >OSSEC does 2 checks to see if a port is open, it tries to > bind to the > >port and checks netstat. If it cannot bind to the port, but netstat > >does not see the port as open this alert will be triggered. > >So if a process has a port open for the bind check, but > closes the port > >before the netstat check the alert will be triggered, but will be a > >fale positive. > > > >I don't know enough about solaris w/zones to know if this fp > scenario > >is likely. > > > >On Wed, Feb 16, 2011 at 2:45 PM, Sebel, Gary M. > <[email protected]> wrote: > >> Hello > >> > >> I am testing OSSEC and have discovered that Solaris > servers running > >> with local zones are reporting odd messages: > >> > >> 2011 Feb 16 08:27:25 (first time detected: 2011 Feb 09 14:59:37) > >> System Audit: Port '779'(tcp) hidden. Kernel-level rootkit or > >> trojaned version of netstat. > >> > >> > >> How is it finding the open ports and reporting on them? I > read if it > >>sees open ports and then notices that they are not open from a > >>netstat it will report this error. Just not sure what command or > >>script is reporting ports listening on what seems like > closed ports. > >> > >> We have tested with netcat and nmap, confirmed with > netstat and lsof > >>that nothing listening on the port and verified this remotely all > >>results show the port closed. > >> > >> Thanks > >> -Gary > >> > >> > > >
bindport
Description: Binary data
portseek
Description: Binary data
