echo -en "open $HOST $PORT\nlogout\quit" | telnet 2>/dev/null | grep 'Connected to' > /dev/null
CONNECT_ERROR=$?
if[$CONNECT_ERROR]; then echo"no good"

HOST=127.0.0.1;for p in {0..65535};do((bash -c "(>/dev/tcp/$HOST/$p)" 2> /dev/null && echo open: $p)&read -t0.1;kill $! 2>/dev/null)2>/dev/null;done

import socket
import getpass
import sys
import telnetlib

#Edit these
HOSTA = "78.32.236.185"
PasswordA = "Sch5636$\n"

HOSTB = "82.111.251.241"
PasswordB = "LLUcpe99\n"

HOSTC = "82.108.105.177"
PasswordC = "LLUcpe99\n"

PORT = "23"



#RAS Commands

jmp1 = "ip telnet "+HOSTB+" "+PORT+"\n"
jmp2 = "ip telnet "+HOSTC+" "+PORT+"\n" 

#Connect to 1st router.
tn = telnetlib.Telnet(HOSTA)
print tn.read_until("Password: ") 
tn.write(PasswordA)
print tn.read_until("ras>")
tn.write(jmp1)

#Connect to second router.
print tn.read_until("Password: ")
tn.write(PasswordB)
print tn.read_until("ras>")
tn.write(jmp2)

#Connect to target system.
print tn.read_until("Password: ")
tn.write(PasswordC)
print tn.read_until("ras>")
tn.write(jmp3)

print tn.read_until("Password: ")
tn.write(PasswordC)
print tn.read_until("ras>")

#!/usr/bin/perl
use IO::Socket;
@ARGV||die'usage: perl scanner.pl host [number of threads]';
($|,$h,$t)=(1,@ARGV,20);$p=65535/$t;
for$n(1..$t){
        pipe($r[$n],$w[$n]);next if fork;
        print IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$_)?"Port $_ open\n":''for($p*($n-1)...$p*$n-1);
        print{$w[$n]}'x';exit;
}
read($r[$_],$x,1)for(1..$t);

@ECHO OFF & ECHO start & (FOR /L %p IN (1,1,65535) DO (FOR /F "tokens=*" %a IN ('netsh diag connect iphost 127.0.0.1 %p ^| find /C /I "[NONE]"') DO ( IF %a == 0 echo %p))) & ECHO stop & @ECHO ON

It’s rather slow since netsh seems to take quite a while to load, so you might want to narrow down the port range a bit ;>.

What I found interesting is the message the “netsh diag connect iphost” command outputs: “Server appears to be running on port(s) [NONE]” which seems to suggest you could enter more than one port to connect to, but I could’nt find out how to do so.

HOST=192.168.178.88;for((port=1;port<=65535;++port));do echo -en "$port ";if wget -F -S -t 1 -T 1 -v -O banner.txt $HOST:$port 2>&1 | grep connected;then echo -en "\n\nport $port/tcp is open\n\n";cat banner.txt;fi;done

wget should also be available on most of the systems. And – the coolest – it does a “banner grabbing” as well. Nice, isn’t it?

Here is an alternative, though not as polished, using curl…

Open ports return this response to our stimulous sorry if line is wrapped:

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  5242  100  5242    0     0  15489      0 --:--:-- --:--:-- --:--:--     0

close ports look like this:

scanning port 122...

curl: (7) couldn't connect to host

———-script———–

## portscanner implimented with curl
#!/bin/bash

if [ $# -ne 1 ]; then
    echo 1>&2 "usage: $0  "
    echo 1>&2 "mode 1 = well known ports 1-1024"
    echo 1>&2 "mode 2 = all ports"
    exit 127
fi

case "$1" in
1)
LIMIT=1024
for ((a=1; a  /dev/null > out
  cat out | grep -v "curl: (7) couldn't connect to host"
done;                           
;;
2)
LIMIT=65535
for ((a=1; a  /dev/null > out
  cat out | grep -v "curl: (7) couldn't connect to host"
done;              
;;
esac

I totally agree. Another great piece of work from you guys. Keep it up!

Any other ideas guys? Any default clients with TCP capabilities (i.e. ftp) is a good candidate for a homegrown port-scanner which doesn’t require root privileges to be run. Also, as Sandro mentioned, using any commonly-supported scripting environments such as Perl is another good candidate.

HOST=127.0.0.1;for((port=1;port<=65535;++port));do echo -en "$port ";if exec 5<>/dev/tcp/$HOST/$port 2>/dev/null;then echo -en "\n\nport $port/tcp is open\n\n";fi;done

@Shoaib: I’ve never seen this specific implementation (telnet parser) of a portscanner in the public, but of course I’m not so naive to think this hasn’t been done before! ;) All in all, this is just another trick of the trade which fits the Agile Hacking book project quite nicely IMHO.

This is really worth using it if you are performing audit in restrictive mode and you see telnet option is available…Bingo!!

@mindcorrosive: the post refers to telnet the client rather than the daemon/server/service