Re: port question

["Sykes, LaShawn" <lashawn.d.sykes () US PWCGLOBAL COM>]

Stone is a TCP/IP packet repeater in the application layer. It repeats TCP and
UDP packets from inside to outside of a firewall, or from outside to inside.

Stone has following features:

1. Stone supports Win32.
Formerly, UNIX machines are used as firewalls, but recently WindowsNT machines
are used, too. You can easily run Stone on WindowsNT and Windows95/98. Of
course, available on Linux, FreeBSD, BSD/OS, SunOS, Solaris, HP-UX and so on.
2. Simple.
Stone's source code is only 3000 lines long (written in C language), so you can
minimize the risk of security holes.
3. Stone supports SSL.
Using OpenSSL, stone can encrypt/decrypt packets.
4. Stone is a http proxy.
Stone can also be a tiny http proxy.
5. POP -> APOP conversion.
With stone and a mailer that does not support APOP, you can access to an APOP
server.

--------------------------------------------------------------------------------

Official Release

stone version 2.1a source package
stone version 2.1 for Win32 package
stone version 2.1 with OpenSSL for Win32 package
Thanks to Mr. Shimizu et al., available on OS/2.


--------------------------------------------------------------------------------

EXAMPLES
outer: a machine in the outside of the firewall
inner: a machine in the inside of the firewall
fwall: the firewall on which the stone is executed
stone 7 outer
Repeats the X protocol to the machine designated by the environmental variable
``DISPLAY''.
Run X clients under ``DISPLAY=inner:7'' on ``outer''.
stone outer:telnet 10023
Repeats the telnet protocol to ``outer''.
Run ``telnet fwall 10023'' on ``inner''.
stone outer:domain/udp domain/udp
Repeats the DNS query to ``outer''.
Run ``nslookup - fwall'' on ``inner''.
stone outer:ntp/udp ntp/udp
Repeats the NTP to ``outer''.
Run ``ntpdate fwall'' on ``inner''.
stone localhost:http 443/ssl
Make WWW server that supports ``https''.
Access ``https://fwall/'' using a WWW browser.
stone localhost:telnet 10023/ssl
Make telnet server that supports SSL.
Run ``SSLtelnet -z ssl fwall 10023'' on ``inner''.
stone proxy 8080
http proxy.
stone outer:pop/apop pop
connect to inner:pop using a mailer that does not support APOP.
Where fwall is a http proxy (port 8080):
stone fwall:8080/http 10023 'POST http://outer:8023 HTTP/1.0'
stone localhost:telnet 8023/http
Run stones on ``inner'' and ``outer'' respectively.
Repeats packets over http.
stone fwall:8080/proxy 9080 'Proxy-Authorization: Basic c2VuZ29rdTpoaXJvYWtp'
for browser that does not support proxy authorization.


Hope this helps.
Cheers,
La Shawn




Vincent Williams <vincent.williams () SCIENTIST COM> on 10/04/2000 02:38:22 AM

Please respond to Vincent Williams <vincent.williams () SCIENTIST COM>
To:   INCIDENTS () SECURITYFOCUS COM
cc:
Subject:  port question



Hi,

Have seen some suspicous activity towards port 10023.
Have done some quick research and found no information at all regarding that
particular port. Does anyone have any knowledge about any trojan or else
that has been seen there?

TIA, Regards
Vincent


______________________________________________
FREE Personalized Email at Mail.com
Sign up at http://www.mail.com/?sr=signup



----------------------------------------------------------------
The information transmitted is intended only for the person or entity to which
it is addressed and may contain confidential and/or privileged material.  Any
review, retransmission, dissemination or other use of, or taking of any action
in reliance upon, this information by persons or entities other than the
intended recipient is prohibited.   If you received this in error, please
contact the sender and delete the material from any computer.