Skowronek.org » SciTech

SSDP Discovery Service on Port 5678

Skowronek — Thu, 10 Jan 2008 05:45:04 +0000

Tonight, I arrived home hoping to jump right in to my “moonlighting” gig only to discover that an issue with my computer from this morning had persisted. For some reason, something, some application was causing a consistent amount of traffic (not large amounts of it mind you) across my local Ethernet connection. Fortunately for me, I am somewhat tech savvy and thus commenced troubleshooting to discover the source rogue application.

First off, sniff the TCP/UDP traffic

After launching TCP Viewer and letting it do its thing for a few seconds, I noticed that there was a group of three or so applications connecting and disconnecting in sequence, port scanning out my machine to my router on destination port 5678. Lo and behold, it ended up being the svchost.exe application. Not just one or two ports, but scanning tens if not hundreds if left to do its thing.

Next, Find the Application and Kill It

I launched Process Explorer to try to figure out if svchost.exe was truly the offending thread. I then isolated the application with the same PID as the one reported in TCP Viewer (in my case 1324). Yep, svchost.exe. Right-click | Kill Application. Bye-bye. No more solid blinking lights across my gigabit Ethernet connection!

Conclusion

Now you ask, what service or application would be sending and receiving such a high rate of packets (ultimately crashing my router due to the amount of hits it was getting)? Well, it turns out that the UPnP services (which I had assumed I had disabled) were for some reason hanging on the requests to my router. All requests were headed to the router’s internal interface (10.0.0.1) on port 5678. From what I can tell, the router was either dropping the packets or not responding properly so the SSDP Discover Service was scanning out ports to try to “do its thing”.

Solution

Launch the local service manager, stop, and then finally DISABLE the following services:

Universal Plug and Play Device Host
SSDP Discovery Service

I do not plan on going in to detail on what these services do, but suffice it to say, they are unnecessary and in this case, a pain in the behind. There are a bunch of other article on this topic, but there did not appear to be one detailing this exact scenario, so hopefully this helps someone else from having to spend hours troubleshooting.

Happy computing

Another Bugatti Veyron Amazement

Skowronek — Tue, 18 Dec 2007 18:13:19 +0000

While browsing one of my favorite automobile wallpaper web sites, I ran across this amazing video. I’ve seen the Lotus Elite against a combat helicopter, but a car vs. fighter jet, how much more wicked can it get!

Index of /wp-content/uploads

Skowronek — Fri, 07 Dec 2007 08:32:02 +0000

Tonight, whilst experimenting with the various advanced Google search techniques (hacks) to locate web content, I had an epiphany. Any web directory/folder that has indexes enabled (show an index of the contents of the folder of no directory index file exists) will list the contents of said directory with the phrase “Index of” followed by the actual root-relative path to available list of assets. This is due to the fact that the directory/folder does not have an index document/file present, so the web server spits out the entire list of the folder’s content. But I digress.

I have been using WordPress as my blogging platform for a few years now. Before that was a hybrid of PHPBB and custom PHP application I wrote. WordPress works great and has robust features that make blogging a snap for the more technical (such as myself, ehem) and also for the less technical netizens out there. Now, one of these great features is the ability to upload pictures and files (content) through a web interface. What a great concept (this is where the epiphany came in) except if you weren’t planning on listing up the contents of your entire uploads folder to the world. which happens to be the case with some (okay a lot of) default installations of WordPress.

Lets say you “Google” the “Index of” any WordPress uploads folders (/wp-content/uploads). You don’t have to be a rock scientist (yes, that was a joke) to realize the possible implications. Let me give you an idea of the figure as of tonight: 4,143,000 indexes. That’s 4,143,000 WordPress installations that have directory indexes enabled and are completely wide open to crawlers and spiders that can pilfer (argh) their content.

Try it yourself: http://www.google.com/search?q=Index+of+%2Fwp-content

There are plenty of other “Index of” combinations out there:

Now obviously if someone is using WordPress and uploading content, it’s more than likely related to their blog, and perfectly okay for the world to sneak a peak. However, for those sites that are using WordPress as a corporate platform, with confidential information (don’t ask me why you would want to do this with WordPress…), this is a huge security issue.

Moral of the story, unplug your computer, no one is safe.

Here are a bunch I found in a forum while actually doing a search on _vti (Front Page extensions).

filetype:htpasswd htpasswd
intitle:"Index of" “.htpasswd" -intitle:"dist"
           -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurl:passlist.txt (para encontrar listas de passwords)
intitle:"Index of..etc" passwd
intitle:admin intitle:login
“Incorrect syntax near" (SQL script error)
intitle:"the page cannot be found" inetmgr
intitle:index.of ws_ftp.ini
“Supplied arguments is not a valid PostgreSQL result"
_vti_pvt password intitle:index.of
inurl:backup intitle:index.of inurl:admin
“Index of /backup"
index.of.password
index.of.winnt
inurl:"auth_user_file.txt"
“Index of /admin"
“Index of /password"
“Index of /mail"
“Index of /" +passwd
Index of /" +.htaccess
Index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: “index of/admin"
allintitle: “index of/root"
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurl:passwd filetype:txt
inurl:admin filetype:db
inurl:iisadmin
inurl:"auth_user_file.txt"
inurl:"wwwroot/*."
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:"Index of" .sh_history
intitle:"Index of" .bash_history
intitle:"Index of" passwd
intitle:"Index of" people.1st
intitle:"Index of" pwd.db
intitle:"Index of" etc/shadow
intitle:"Index of" spwd
intitle:"Index of" master.passwd
intitle:"Index of" htpasswd
intitle:"Index of" members OR accounts
intitle:"Index of" user_carts OR user _cart

Hacking the iPhone

Skowronek — Tue, 27 Nov 2007 20:16:22 +0000

Got this from a friend today. Since I do not own an iPhone (but I do own a smartphone), this is a little disturbing to me.

Here is the original article on hacking the iPhone on FastCompany.com.

Thoughts of E.L.I.

Skowronek — Sat, 24 Nov 2007 05:23:57 +0000

Not sure exactly what prompted my interest in this topic tonight, but I recalled a Japanese simulation I saw online a while back in which an enormous interstellar object (like an asteroid or comet) was shown to have impacted the earth. I was able to find various renditions on YouTube and am posting the one I felt had a good accompaniment.

Incidentally, it turns out there is a known asteroid that has the potential of impacting the earth (somewhere near the year 2800 AD).

Note to self: How to perform “clean” reset an iPAQ hx2795

Skowronek — Fri, 09 Nov 2007 06:42:53 +0000

So I’ve overloaded my PDA. Apparently, installing too much in the main memory can cause it to halt, and then never boot again. The problem is that with Windows Mobile 5, it has this neat “feature” that keeps data in the RAM even after a “hard reset”. This does not really help me, since I have too much in the main RAM. So, you do whats called a “clean” reset. Thanks HP for the help.

On Windows Mobile 5.0 products, a hard (full) reset stops all running programs, but does not clear user data or applications because they are stored in ROM (Persistent Store feature). A hard reset also resets all hardware registers. Users can perform a Clean Reset, in which the product is cleared to its factory defaults. A clean reset returns the HP iPAQ to the default Windows Mobile 5.0 settings with no user data or applications.

To perform a clean reset please follow these steps:

Press and hold the Calendar button, the Power button, and the Messaging button.

While holding these buttons, use the stylus to lightly press the Reset button on the bottom of the HP iPAQ.

The Secret of NIMH, Live Action

Skowronek — Fri, 02 Nov 2007 16:53:48 +0000

Apparently certain scientists were deprived as children in not having seen the The Secret of NIHM. I wonder if they would have been so anxious to further this research had they actually seen what happens when you mix rats with genetic research.

The mouse that shook the world

Actual working bi-ped Mecha

Skowronek — Sat, 30 Sep 2006 16:44:05 +0000

As I worked over 60 hours this week, I haven’t had time to really even see anything out there interesting to write about. I did have this in my inbox from a while ago so I figured I’d put it online. Not quite the Robotech Mecha that I would like to see, but hey, its a step forward in the right direction.

Battery Driven Car : Tesla

Skowronek — Tue, 22 Aug 2006 22:36:51 +0000

Yes, I realize this is an fairly stale article, but IÂ had originally planned on posting a while ago but had forgotten about it.Â I don’t think $80k puts it within my price range, nor the fact it runs on highly volatile lithium ion batteries, but hey, its still pretty darn spectacular.

See theÂ wired article

Flat panel mouse?

Skowronek — Wed, 26 Jul 2006 19:49:45 +0000

I was doing my daily dose of blog reading (during lunch of course) and ran across this article. Not sure exactly why you would ever do this other than to say you could. Hope you enjoy.