Topic: Port Scanning (Read 1012 times)

Slack3er · « **Reply #15 on:** November 26, 2005, 07:51:00 PM »

That's strange, I can connect fine using both Windows XP or Linux. The only thing, that I did with my 360 was get all the xbox live updates & it always autosigns in. I didn't setup media connect or center. There's nothing that I can think that I'm doing differently. I'm using firefox, just type http://ipaddressof360:1026 into the address bar. It should bring back this:

This XML file does not appear to have any style information associated with it. The document tree is shown below. ......etc

BTW, I also can't ping my xbox. For a test, try doing a port scan on the 360. What ports do you see open?

PS: I'm using the premium system, do you have the core? Maybe the file is being served from the harddrive.

Cheers;

This post has been edited by Slack3er: Nov 27 2005, 04:11 AM

wolrahnaes · « **Reply #16 on:** November 26, 2005, 09:06:00 PM »

Summary of the thread so far:

The 360 has a very locked down IP networking system by default. It silently rejects all IP (TCP, UDP, and ICMP) traffic other than TCP on port 1026.

Investigation of TCP 1026 discovered a basic HTTP service running on that port. It is a UPnP service description, showing the 360 as a UPnP Media Renderer. This is undoubtedly for the 360's functionality as a Media Center Extender.

DonkeyBeliever · « **Reply #17 on:** November 27, 2005, 05:08:00 AM »

Pinging/Connecting works fine on my side here so Slack3r isnt alone (IMG:style_emoticons/default/smile.gif) nmap scan also shows up the same, good work I didn't even think of trying a port scan on this little puppy!

Let me know if I can help in anyway testing stuff out etc... Thanks!

Dameon · « **Reply #18 on:** November 27, 2005, 10:36:00 AM »

Could someone here get some packet dumps between MCE and Xbox?

Slack3er · « **Reply #19 on:** November 27, 2005, 05:43:00 PM »

http://www.4shared.com/file/528528/869007c...ox360toWMC.html <-The download button in at the bottom.

Here's a packet dump of WMC to Xbox 360. I used ethereal, just open the file with it. I don't have media center, so I used media connect instead. What I did was left ethereal sniffing, start xbox & mc, mc found the 360. I shared some folders. Then just viewed them onto my 360.

Just a though, the first file that I posted above. Looks like its for idenifying, the 360 to media connect. You were right that port 1026 is used for MC, if you look at the dump. 192.168.0.101 is my computer running XP + MC & 102 is the 360.

Cheers;
Slack3er

unspoiledpuma · « **Reply #20 on:** November 27, 2005, 08:52:00 PM »

i just check this with firefox but i cannot connect with IE

http://adressxbox360...enderingControl
http://adressxbox360...nnectionManager

Slack3er · « **Reply #21 on:** November 28, 2005, 08:28:00 AM »

After thinking about it, I removed the above link. The file contains identifing data, so if you did download it. I hope you respect, my request not to repost the file. Please keep it for studing nothing more.

This post has been edited by Slack3er: Nov 28 2005, 04:29 PM

DonkeyBeliever · « **Reply #22 on:** November 29, 2005, 02:51:00 AM »

Slack3er: You said you are just using Media Connect on your machine correct? You wouldnt happen to have a copy of Windows XP MCE to test it out to see if you get similar results would you? I have my friends MCE installing right now on a Virtual Machine, but I am a total noob when it comes to using anything other than nmap to do a simple port scan.

If you could walk me though using Ethereal to get a dump from connecting a Media Center PC I wouldn't mind helping the cause let me explain my setup here.

I have 2 Boxes up and running right now 1 Running Windows XP SP2 with XP Media Center Edition running in a Virtual Machine and on the second box I have Ubuntu loaded with nmap and Ethereal (I am a total noob with Ethereal but Im a quick learn) I can be contacted via any Major IM Services, but im on Hawaii Standard Time so my hours might seem a bit odd, Im off on friday though drop me a PM.

Slack3er · « **Reply #23 on:** November 29, 2005, 08:30:00 AM »

Yes only connect, I can only view images. I would like to have Windows XP MCE, but don't.

No problem, I don't mind helping. Can we just use email, this board or pm's. I really don't like IM, with work or some answers may require me to search around abit. With the other ways, I can take my time & give you better answers.

To start, I'm going to post some general tips, if anyone else is interested.

Using Ethereal to acquire TCP/IP Traffic between a computer and Xbox 360:

I have never setup Windows XP MCE before, so your going to have to read that yourself: Here's a link to help you get started.
http://www.xbox.com/...-media-mcpc.htm

One thing you should know, that dump will contain your 360 Serial Number, MAC address, etc. If you post it online, its there for anyone to view, yes even MS. Could they use that info to ban you for xbox live, maybe, I don't really know. But warning you its a chance you must understand. Also running a sniffer like ethereal on you network, if passwords or other personal data is sent across your network. It could be picked up & then if you post it online, bad things could happen.

Also I have used VM software like VMWare before, but I'm no expert with it. As long as you can get MCE working with your xbox you'll get a dump.

Ethereal is cross-plateform, so it works on Linux/BSD/Windows. I would install ethereal, onto the VM that is running MCE. I don't think ethereal will see the traffic, if you run it from your second box. Also I would temp disable UPNP on your router, it will make your results in ethereal easlier to read. Turn it back on when your done, if you wish.

First step would be make sure MCE & the 360 is correctly working. Try viewing images, just to make sure it works. Then turn off your xbox, just to make sure your kill the connection.

Start ethereal on the VM, go to Capture & options. Change interface, to your Nic card. Check the option to update packets in real time. Then hit start. Now leave it.

Now turn on your xbox, connect it to MCE. View some images/video. That will make some traffic, if you look at ethereal you'll see its collecting packets.

Turn off your xbox. Hit stop on ethereal & save the dump.

As for analyzing the dump, The top window contains the packets, inorder they were recorded. The bottom windows, is what the packets contains.

And that's about it, try it & see what happens. If you run into problems, I'll be around.

Regards;
Slack3er

xbox7387 · « **Reply #24 on:** November 30, 2005, 07:37:00 PM »

well at first i didnt suceed when scanning for open ports, but i found out it was because i had the ping check enable so it wouldnt work. also the first time i scanned, ports 25 110 and 1026 were open then i loaded a game went back to the dashboard and now it was the same only instead of 1026 it was now 1028. i also got on live to scan again and i got 25 110 1002 1032(which used to be 1026/1028) and 1720. no luck with any of them though

SilentWatcher · « **Reply #25 on:** December 01, 2005, 06:31:00 PM »

Who whoa wait. Are you sure it's your Xbox? 25 is SMTP and 110 is POP3. Xbox 360 is a mail server?

Monoxboogie · « **Reply #26 on:** December 01, 2005, 09:35:00 PM »

QUOTE(SilentWatcher @ Dec 2 2005, 02:38 AM)

Who whoa wait. Are you sure it's your Xbox? 25 is SMTP and 110 is POP3. Xbox 360 is a mail server?

Assuming it wasn't an error on the behalf of the person doing the scanning, I wouldn't put it by MS to run services on non-standard ports in order to further obscure the exact service running on them. I used to run a terminal server on port 110, because 110 outbound wasn't blocked by the firewall at work. I could then browse the web or do anything I wanted using my home box as a proxy. Point is, anybody with half a brain can configure a service to run on a different port; standard does not mean "etched in stone."

...but I'd be quicker to assume that it was an error on Mr(s?) Xbox's behalf.

scotty2hotty1124 · « **Reply #27 on:** December 01, 2005, 09:51:00 PM »

QUOTE

Who whoa wait. Are you sure it's your Xbox? 25 is SMTP and 110 is POP3. Xbox 360 is a mail server?

This may be a stupid idea...but the 360 can send and recieve messages back and forth right? so... although xbox live uses a port to play games and download and such...maybe it could use these ports to send the messages back and forth.....just an idea...

xbox7387 · « **Reply #28 on:** December 02, 2005, 02:10:00 AM »

i agree it did strike me as strange when those two ports showed up but they did, i guess since it is only me having these results, i will get a diff port scanner and check it out tomorrow when i get home.

Jay-Rod

DonkeyBeliever · « **Reply #29 on:** December 02, 2005, 06:44:00 PM »

Hrm, I cant seem to update to rollup 2 for MCE with my 60 day trial key... what gives? Guess they don't want me to trial it... Plus its complaining about the Video card of the emulated machine... Anyone using MCE with Virtual PC 2005?

Author Topic: Port Scanning (Read 1012 times)