Network Security Hacks [Electronic resources] نسخه متنی

Hack 23 List Running Services and Open Ports

Check for remotely accessible services the
Windows way.

Unix makes it quick
and easy to see which

ports on a system are open, but how
can you do that on Windows? Well, with FPort from Foundstone (http://www.foundstone.com/resources/index_resources)
it's as quick and easy as running good old
netstat.

FPort has very few command-line options, and those deal mostly with
specifying how you'd like the output sorted. For
instance, if you want the output sorted by application name, you can
use /a; if you want it sorted by
process ID, you can use
/i. While it may not be as full of features as
netstat, it definitely gets the job done.

To get a listing of all ports that are open on your system, simply
type fport. If you want the list to be sorted by
port number, use the /p switch:

C:\> fport /p
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com
Pid   Process            Port  Proto Path
432   svchost        ->  135   TCP   C:\WINNT\system32\svchost.exe
8     System         ->  139   TCP
8     System         ->  445   TCP
672   MSTask         ->  1025  TCP   C:\WINNT\system32\MSTask.exe
8     System         ->  1028  TCP
8     System         ->  1031  TCP
1116  navapw32       ->  1035  TCP   C:\PROGRA~1\NORTON~1\navapw32.exe
788   svchost        ->  1551  TCP   C:\WINNT\system32\svchost.exe
788   svchost        ->  1553  TCP   C:\WINNT\system32\svchost.exe
788   svchost        ->  1558  TCP   C:\WINNT\system32\svchost.exe
1328  svchost        ->  1565  TCP   C:\WINNT\System32\svchost.exe
8     System         ->  1860  TCP
1580  putty          ->  3134  TCP   C:\WINNT\putty.exe
772   WinVNC         ->  5800  TCP   C:\Program Files\TightVNC\WinVNC.exe
772   WinVNC         ->  5900  TCP   C:\Program Files\TightVNC\WinVNC.exe
432   svchost        ->  135   UDP   C:\WINNT\system32\svchost.exe
8     System         ->  137   UDP
8     System         ->  138   UDP
8     System         ->  445   UDP
256   lsass          ->  500   UDP   C:\WINNT\system32\lsass.exe
244   services       ->  1027  UDP   C:\WINNT\system32\services.exe
688   IEXPLORE       ->  2204  UDP   C:\Program Files\Internet Explorer\IEXPLORE.EXE
1396  IEXPLORE       ->  3104  UDP   C:\Program Files\Internet Explorer\IEXPLORE.EXE
256   lsass          ->  4500  UDP   C:\WINNT\system32\lsass.exe

Notice that there are some processes listedsuch as
navapw32, putty, and
IEXPLOREthat don't appear
to be services. These show up in the output because FPort lists all
open ports, not just opened ports that are listening.

While FPort is not as powerful as some of the commands available
under other operating systems, it is still a valuable, quick, and
easy-to-use tool that is a great addition to Windows.