|
Port 2004 Details
known port assignments and vulnerabilities
threat/application/port search:
| Port(s) |
Protocol |
Service |
Details |
Source |
| 2004 |
tcp |
trojans |
Duddie, TransScout
Backdoor.Win32.NinjaSpy.c / Remote Command Execution - the malware listens on TCP ports 2003, 2004 and drops a DLL named "cmd.dll" under Windows dir. Connecting to port 2003, you will get back a number "9951" from the infected host. If we send the value 1000 we get a message in Portugese "Pisca Pisca Ativado" translates to "Blink Blink Activated". If we connect to port 2004 and send "abc123" we get message "Acesso negado..." translates to "Access denied". However, if you take the initial number we received earlier (9951) when connecting to port 2003 and apply some calculation we expose hidden functionality. Take the 9951 value and invert the first two digits to 66 and then add together the last two 5 + 1 to equal 6 for a final value of "666". Example, initial number (9951) 99 inverted equals 66 and 5 + 1 = 6. Enter and send the constructed value of "666" to port 2003 and TCP port 999 is opened. Connect to port 999 and you get back a remote shell.
References: [MVID-2021-0202] |
SG
|
| 2004 |
tcp |
trojan |
Duddie |
Trojans
|
| 2004 |
tcp |
TransScout |
[trojan] TransScout |
SANS
|
| 2004 |
tcp |
mailbox |
mailbox |
Nmap
|
| 2004 |
udp |
eDonkey2000 |
eDonkey2000 unknown/unlisted port |
Neophasis
|
| 2004 |
tcp,udp |
threat |
OICQSer |
Bekkoame
|
| 2004 |
udp |
emce |
CCWS mm conf |
IANA
|
|
7 records found
Related ports: 2002 2003 2005
|