Can’t find a vulnerable program in a device

Posted by ReactNativeIsTooHard@reddit | sysadmin | View on Reddit | 8 comments

Hey fellow sysadmins Company is finally starting vulnerability scans, I’ve thankfully mitigated quite a few. There’s one pretty big vulnerability that I cannot seem to find in order to mitigate. The vulnerability has something to do with Mongoose Web Server, I know which device it is on too. But I cannot find any programs dealing with said service, nothing in the “Program Files”, or installed programs in Control Panel, nothing in services.msc, a simple windows search doesn’t show it. The device isn’t serving anything like a web page either. Any ideas?

Reply to Post

8 Comments

[-]

Fun_Permission_888@reddit

If the scan was on the wire, it will show the port Look at netstat and see the process running on that port

[-]

pdp10@reddit

Mongoose is a somewhat-common embedded web server. Look for your port bindings with `netstat -an`. I'm intrigued what Win32 package might be using Mongoose.

[-]

RigourousMortimus@reddit

It's a library so it is likely compiled into whatever service is used for managing the device "One of the most common use cases is to use Mongoose to add a Web-accessible control panel for a device" https://mongoose.ws/ https://github.com/cesanta/mongoose

[-]

Pete263@reddit

Take a look at the details of the vulnerability scan. There is either the used port or the binaries listed.

[-]

ReactNativeIsTooHard@reddit (OP)

Scanned outside!

[-]

Pete263@reddit

With my knowledge about Tenable and Greenbone I would recommend to change to inside. You get more findings and the results are more detailed and reliable.

[-]

KStieers@reddit

Vuln scan will tell you what port it finds mongoose on. Running Netstat -b On the box should tell you what exe has that port open and listening. Then go find that exe...

[-]

ReactNativeIsTooHard@reddit (OP)

I’ll try that!!