Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71384
HarpyEagle Port Analysis
Airport Extreme – Open Ports
| Airport Extreme | Airport Time Capsule | ||||||||
|---|---|---|---|---|---|---|---|---|---|
|
Internal Interface - LANLocal Area Network (10.0.1.1) |
External Interface - WANWide Area Network (10.7.1.101) |
Bridged Mode External Interface - WANWide Area Network (10.7.1.102) |
|||||||
| Family | Port | Protocol | Family | Port | Protocol | Family | Port | Protocol | |
| TCP | 53 | domain? | no open TCPTransport Control Protocol ports found on WAN | TCP | 139 | SMB (netbios-ssn) | |||
| TCP | 5009 | airport-admin | TCP | 445 | SMB domain server (microsoft-ds) | ||||
| TCP | 10000 | snet-sensor-mgmt? | TCP | 548 | Apple Filing Protocol (AFP) over TCP | ||||
| TCP | 5009 | airport-admin | |||||||
| TCP | 10000 | snet-sensor-mgmt? | |||||||
| UDP | 53 | domain? | no open UDPUser Datagram Protocol ports found on WAN | UDP | 5353 | mdns | |||
| UDP | 192 | osu-nms | |||||||
| UDP | 5351 | nat-pmp | |||||||
| UDP | 5353 | mdns | |||||||
Airport Extreme – Nmap Script Results
# for TCP:
nmap -vv -d -Pn -n --send-ip -sT -p- -A -oN <output-filename> -T4 <ip>
# for UDP:
nmap -vv -d -Pn -n --send-ip -sU -p- -A -oN <output-filename> -T4 <ip>5351/udp open nat-pmp udp-response
| nat-pmp-info:
|_ WANWide Area Network IP: 10.7.1.1015353/udp open mdns udp-response DNS-based service discovery
| dns-service-discovery:
| 5009/tcp acp-sync
| cu=4dde65b7-ee90-555f-a5a9-f20ee14e9322
| nm=edb's AirPort Extreme
| mac=6C:70:9F:D6:85:8B
| ssid=edb's Wi-Fi Network
| bssinfo=AQKEgIYQAAAJbHCf5mRlAVGGCAAAB2xwn+ZkZA
| Address=10.0.1.1 fe80:0:0:0:6e70:9fff:fed6:858b
| 5009/tcp airport
| waMA=6C-70-9F-D6-85-8B,raMA=6C-70-9F-E6-64-65,raM2=6C-70-9F-E6-64-64,raNm=edb's Wi-Fi Network,raCh=132,rCh2=1,raSt=0,raNA=1,syFl=0x8A2C,syAP=120,syVs=7.7.3,srcv=77300.1,bjSd=21,prob=DubN
| model=AirPort7,120
| Address=10.0.1.1 fe80:0:0:0:6e70:9fff:fed6:858b
| 65072/udp sleep-proxy
|_ Address=10.0.1.1 fe80:0:0:0:6e70:9fff:fed6:858bNetwork Capture Diagram
DNS/Linux Box <---------------------------------->Airport | Extreme<-------------------------------------->MAC Notebook
192.0.2.1 192.0.2.102 | 10.0.1.1 10.0.1.1
All ports closed | Open Ports
| 53/tcp
| 5009/tcp
| 10000/tcp
Nmap scan of Airport Extreme's 10.0.1.1 Local Area Network Port (nmap -T4 -A -v 10.0.1.1 >> nmap0.txt &) :
Starting Nmap 6.47 ( http://nmap.org ) at 2015-01-28 10:16 PST
NSE: Loaded 118 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 10:16
Scanning 10.0.1.1 [2 ports]
Completed Ping Scan at 10:16, 0.00s elapsed (1 total hosts)
Initiating Parallel DNSDomain Name System resolution of 1 host. at 10:16
Completed Parallel DNSDomain Name System resolution of 1 host. at 10:16, 0.00s elapsed
Initiating Connect Scan at 10:16
Scanning 10.0.1.1 [1000 ports]
Discovered open port 53/tcp on 10.0.1.1
Increasing send delay for 10.0.1.1 from 0 to 5 due to max_successful_tryno increase to 5
Increasing send delay for 10.0.1.1 from 5 to 10 due to max_successful_tryno increase to 6
Discovered open port 10000/tcp on 10.0.1.1
Discovered open port 5009/tcp on 10.0.1.1
Completed Connect Scan at 10:17, 12.67s elapsed (1000 total ports)
Initiating Service scan at 10:17
Scanning 3 services on 10.0.1.1
Service scan Timing: About 66.67% done; ETC: 10:19 (0:00:39 remaining)
Completed Service scan at 10:18, 106.06s elapsed (3 services on 1 host)
NSE: Script scanning 10.0.1.1.
Initiating NSE at 10:18
Completed NSE at 10:19, 30.02s elapsed
Nmap scan report for 10.0.1.1
Host is up (0.0013s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
53/tcp open domain?
5009/tcp open airport-admin Apple AirPort or Time Capsule admin
10000/tcp open snet-sensor-mgmt?
| ndmp-version:
|_ ERROR: Failed to get host information from server
NSE: Script Post-scanning.
Read data files from: /usr/local/bin/../share/nm
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 149.33 seconds
Second Nmap scan of Airport Extreme's 10.0.1.1 Local Area Network Port (nmap -T4 -A -v -p X -sM -sV -O 10.0.1.1 >> nmap2_20150129.txt &):
where X=1-65355 (Could not get it to print properly).
NSE: Loaded 118 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 11:59
Scanning 10.0.1.1 [2 ports]
Completed Ping Scan at 11:59, 0.00s elapsed (1 total hosts)
Initiating Parallel DNSDomain Name System resolution of 1 host. at 11:59
Completed Parallel DNSDomain Name System resolution of 1 host. at 11:59, 0.00s elapsed
Initiating Connect Scan at 11:59
Scanning 10.0.1.1 [65535 ports]
Discovered open port 53/tcp on 10.0.1.1
Increasing send delay for 10.0.1.1 from 0 to 5 due to 11 out of 23 dropped probes since last increase.
Increasing send delay for 10.0.1.1 from 5 to 10 due to max_successful_tryno increase to 5
Connect Scan Timing: About 2.42% done; ETC: 12:21 (0:20:48 remaining)
Warning: 10.0.1.1 giving up on port because retransmission cap hit (6).
Discovered open port 10000/tcp on 10.0.1.1
Connect Scan Timing: About 8.03% done; ETC: 12:21 (0:19:40 remaining)
Connect Scan Timing: About 13.17% done; ETC: 12:21 (0:18:34 remaining)
Connect Scan Timing: About 19.09% done; ETC: 12:21 (0:17:27 remaining)
Connect Scan Timing: About 24.35% done; ETC: 12:21 (0:16:22 remaining)
Connect Scan Timing: About 28.96% done; ETC: 12:21 (0:15:15 remaining)
Connect Scan Timing: About 33.76% done; ETC: 12:21 (0:14:10 remaining)
Connect Scan Timing: About 38.59% done; ETC: 12:21 (0:13:05 remaining)
Connect Scan Timing: About 43.52% done; ETC: 12:21 (0:11:58 remaining)
Connect Scan Timing: About 48.37% done; ETC: 12:20 (0:10:54 remaining)
Connect Scan Timing: About 49.32% done; ETC: 16:50 (2:27:06 remaining)
Connect Scan Timing: About 53.11% done; ETC: 16:30 (2:06:51 remaining)
Connect Scan Timing: About 57.46% done; ETC: 16:10 (1:46:44 remaining)
Connect Scan Timing: About 61.81% done; ETC: 15:53 (1:29:23 remaining)
Connect Scan Timing: About 66.16% done; ETC: 15:39 (1:14:15 remaining)
Connect Scan Timing: About 70.51% done; ETC: 15:26 (1:00:56 remaining)
Connect Scan Timing: About 74.86% done; ETC: 15:15 (0:49:06 remaining)
Connect Scan Timing: About 79.20% done; ETC: 15:05 (0:38:30 remaining)
Connect Scan Timing: About 83.56% done; ETC: 14:55 (0:28:58 remaining)
Connect Scan Timing: About 88.34% done; ETC: 14:47 (0:19:30 remaining)
Connect Scan Timing: About 93.13% done; ETC: 14:39 (0:10:56 remaining)
Connect Scan Timing: About 98.35% done; ETC: 14:31 (0:02:30 remaining)
Discovered open port 5009/tcp on 10.0.1.1
Completed Connect Scan at 14:29, 8970.33s elapsed (65535 total ports)
Initiating Service scan at 14:29
Scanning 3 services on 10.0.1.1
Service scan Timing: About 66.67% done; ETC: 14:31 (0:00:40 remaining)
Completed Service scan at 14:31, 106.06s elapsed (3 services on 1 host)
NSE: Script scanning 10.0.1.1.
Initiating NSE at 14:31
Completed NSE at 14:31, 30.01s elapsed
Nmap scan report for 10.0.1.1
Host is up (0.0013s latency).
Not shown: 64826 closed ports, 706 filtered ports
PORT STATE SERVICE VERSION
53/tcp open domain?
5009/tcp open airport-admin Apple AirPort or Time Capsule admin
10000/tcp open snet-sensor-mgmt?
| ndmp-version:
|_ ERROR: Failed to get host information from server
NSE: Script Post-scanning.
Read data files from: /usr/local/bin/../share/nmap
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9106.80 seconds
| TCP | 5009 | Admin |