Port 4531

[Phylum]

I just finished performing a vulnerability assessment scan on a clients Win 2003 3790 server running IIS 6.0.

Using our tool (and others) port 4531 came up several times, each time with a different issue.
First: Possible Backdoor iise.exe - //admin.dll
Second: Web server tries to hide its version or name however using a special crafted request, we were able to discover it
Third: directories /help & /images were discovered
Fourth: Web server type is Microsoft-IIS/6.0
Fifth: Web server running on that port.

I'm not too familiar with IIS but why would it be "running" on that port? As far as I know, they have their server setup to run on port 80 (pursuant to other scans and the fact that we don't have to type host:4531 to get to the page nor are we redirected from host:80 to host:4531 when the page is accessed normally) but what purpose does port 4531 serve?

 

[ChrisHirst]

probably the "Administration Web Site". It assigns a random port on install.



Chris.

Indifference will be the downfall of mankind, but who cares?

http://www.candsdesign.co.uk

A website that proves the cobblers kids adage.

http://www.cram-system.com

Nightclub counting systems

So long, and thanks for all the fish.

 

[Phylum]

And that port can be changed of course.

I found this in Microsofts Site regarding the remote administration & administration web suite.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;324282

http://www.microsoft.com/resources/documentation/iis/6/all/proddocs/en-us/iiswelcome.mspx

The second site doesn't detail anything about chaning the port. This looks good - thanks for the info. I'll continue researching that site and go from there.

 

[ChrisHirst]

and of course if it's not used, stop it or even delete it completely.

usually it's only accessible on an internal IP and is set for authentication.

to change the port;
in the IIS MMC,
RC the "Administration Web Site" select properties -> Click Advanced... -> Highlight the entry then Edit...

Chris.

Indifference will be the downfall of mankind, but who cares?

http://www.candsdesign.co.uk

A website that proves the cobblers kids adage.

http://www.cram-system.com

Nightclub counting systems

So long, and thanks for all the fish.