so when I type in nc -L -vv -p 37000 in my system..netstat lists the port as microsoft-ds rather than 37000.



netstat -a
TCP home-7hqkh9el41:microsoft-ds home-7hqkh9el41:0 LISTENING

I don't know exactly what you are trying to do or why, so its hard to get specific.

As mentioned, you could just name the port. This won't fool packet logging, firewalls, third party socket enumeration or anyone doing netstat with the -n option etc. So, the question remains, exactly WHO or WHAT are you hiding the port from.

As a basic example. lets imagine the user is running a basic common firewall (like ZA). It has a list of all socket using processes and open ports. It also NUMBERS them; so simple naming, although it may confuse some people, is unlikely to confuse those too weak to know netstat or strong enough to use netstats options. But, thats still a lot of people I guess.


To truly hide a socket from netstat one can either:

1) Filter netstats output through an intermediate program (Fake telnet calls real telnet passing on any options, collects output of real telnet by calling it with redirected streams, and returns the output line by line but omitting any lines fitting the criteria) Said program is very simple to write in C and would either replace or wrap original telnet. I seem to remember a short Dr. Dobbs Journal article on calling a console mode program from C with redirected iostreams.

2) For the more adept coder one could tamper with the actual objects being returned in the enumeration. This can involve simply shimming the existing API or shimming core DLL's related with returning MIBs.


However, to truly hide a socket on a windows system it is important NOT to use a socket in the first place. Depending on how well you wish to hide the communication you can either:

3) ignore the winsock API function and instead originate the communication from inside the stack (Using the Service Provider Interface)

4) Base your code around NDIS and the Miniport drivers and incorporate your own micro-stack into your code. Of course, such a stack wouldn't have to be fully featured but could even constitute your own proprietary protocol (Making it useful for sneaking past firewall ACL's or an IDS located beyond the local machine) for example, it could be made to resemble CDP packets or use SYN's in a nonstandard way.


I know of several different approaches that other people have taken in this regard but its always involved coding at one level or another. I've never seen public tools that do the job correctly.

Perhaps if you have a specific scenario in mind there may be a more direct course of action. As I said, it all boils down to WHO or WHAT you wish to hide ports from.


Hey, thats probably not the answer you wanted. But its an answer

SG

you didnt even noticed what i said! i said a range of ports!!! and yes i know that kind of root kit but it hides single ports as i said! in my opinion you just posted for nothing... sorry...

SlippyG

l0l! yea you were right... its not the answer i wanted... :\

vnet576
very good tip it will help me in other thing, but you didnt help me also


BTW
im trying to hide a range of ports of an xdcc bot on my computer that my father wouldn't notice by using netstat/fport, and yes he knows fport!

and i thought about a generator that will make the whole numbers of a range(for example: the range 1000-4000 the generator will generate 1000,1001,1002....3998,3999,4000 , understood?) and i will put it in the conf of the root kit... but there isnt a limition that the root kit can handle?


10x 4 all the helpers

i said he just posted for nothing and i apologized(or how i t called) to him...

what would happen if people were posting for nothing?! its not the issue as i said in the main post...

netranger - 10x for the help but i could easly fake netstat if ill just replace it.. the real problem is fport :\, but it would ne nice from you to send me the code man

Dont use the -vv and it will work fine. Just tried it and it worked.

heh, should hardly surprise anyone here, especialy considering the source and destination port fields in the header are both 16 bits wide.

All you're seeing is a simple programming choice. If the number is too big you either AND 0xFFFF (trim it to 16 bits) or you kick up an error and try to make the user look stupid, the coders elected for the former in this instance.


SG

It's work fine