|
Port 9997 Details
known port assignments and vulnerabilities
threat/application/port search:
| Port(s) |
Protocol |
Service |
Details |
Source |
| 9997 |
tcp |
splunk |
Splunk (big data analysis software) uses the following ports by default:
514 - network input port
8000 - web port (clients accessing the Splunk search page)
8080 - index replication port
8089 - management port (splunkd, aslo used by deployment server)
9997 - indexing port (web interface)
9998 - SSL port
Football Manager Live also uses port 9997 (TCP/UDP).
Malware that uses this port: W32.dabber.a trojan
Backdoor.Win32.SVC / Remote Stack Buffer Overflow - the malware listens on TCP port 9997. Third-party attackers who can reach an infected system can make an specially crafted HTTP GET request to trigger a classic stack buffer overflow overwriting ECX, EIP registers and structured exception handler (SEH).
References: [MVID-2022-0446]
Backdoor.Win32.SVC / Directory Traversal - the malware listens on TCP port 9997. Third-party attackers who can reach an infected host can read any file on the system using "../" path traversal characters to break out of the root dir.
References: [MVID-2022-0447] |
SG
|
| 9997 |
tcp,udp |
palace-6 |
Palace-6 |
IANA
|
| 9990-9999 |
tcp |
applications |
DOT.TUNES |
Portforward
|
|
3 records found
Related ports: 514 8000 8080 8089 9920 9995 9996 9998 9999
|