what is /usr/bin/setpty ?

coolguy21 · 2018-03-19 23:08:48

I can't find anything on google for this. What does this command do? Anybody know?
It wants to connect to the internet so i'm sussing it out.. why would it want that?

jasonwryan · 2018-03-19 23:14:39

pacman -Qo /usr/bin/setpy

coolguy21 · 2018-03-19 23:23:28

jasonwryan wrote:

pacman -Qo /usr/bin/setpy

$ pacman -Qo /usr/bin/setpty 
error: No package owns /usr/bin/setpty

jasonwryan · 2018-03-19 23:32:22

setpy is not the same as setpty - what is the actual name of the application?

coolguy21 · 2018-03-19 23:37:58

it's setpty not setpy. I don't know what application it is, only discovered it by popping up by my firewall asking for a connection.

/usr/bin/setpty (pid=743) wants to connect to X.X.X.X on TCP port 443 (https)

jasonwryan · 2018-03-19 23:47:22

How did you install Arch?

coolguy21 · 2018-03-19 23:55:01

using the official arch iso.. a while back actually.. it was a release in 2016 June I believe. I've been package updating since then.
So this pty is not an official program i take it. Not even in the aur? That doesn't sound good right?

jasonwryan · 2018-03-19 23:59:58

Well, pacman doesn't seem to know about it. Have you installed software some other way?

What is the output of `file /usr/bin/setpty`?

coolguy21 · 2018-03-20 00:12:12

$ file /usr/bin/setpty
/usr/bin/setpty: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=619ad609274ee66f301127a20cc1f2fc31411268, stripped

loqs · 2018-03-20 00:16:12

Is it still running, if so what is the parent of the process?

progandy · 2018-03-20 00:22:36

Maybe the file contains some text you can use to identify it (strings is part of binutils)

strings /usr/bin/setpty

coolguy21 · 2018-03-20 00:30:13

Parent: systemd
It has something to do with Debian perhaps?

$ strings /usr/bin/setpty
/lib64/ld-linux-x86-64.so.2
libc.so.6
socket
strcpy
htons
connect
inet_ntoa
recv
inet_addr
setsockopt
gethostbyname
close
sleep
__libc_start_main
__gmon_start__
GLIBC_2.2.5
UH-x
fffff.
gfff
[]A\A]A^A_
debian.org
verifyui.archlinux.org
;*3$"
GCC: (Debian 4.9.2-10) 4.9.2
GCC: (Debian 4.8.4-1) 4.8.4
.shstrtab
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.jcr
.dynamic
.got
.got.plt
.data
.bss
.comment

loqs · 2018-03-20 00:49:17

Is the parent systemd PID 1 or systemd --user with a higher PID? If the former some system service started it possibly, if the latter some user service may have started it.

coolguy21 · 2018-03-20 01:06:06

Parent ID is 1. It appears under systemd as root. How do I know which system service started it?

loqs · 2018-03-20 01:13:31

systemd-cgls

waitnsea · 2018-03-20 03:56:43

coolguy21 wrote:

Parent ID is 1. It appears under systemd as root. How do I know which system service started it?

Hi,
Found that, coming from symfony ?

seth · 2018-03-20 07:03:08

wants to connect to X.X.X.X on TCP port 443

The actual IP may reveal something (in particular what it's trying to phone) - "man whois"

coolguy21 · 2018-03-20 09:36:09

https://en.wikipedia.org/wiki/Internet_ … Consortium

Looks like a root dns server.

$ whois 149.20.4.15

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml
#


#
# The following results may also be obtained via:
# https://whois.arin.net/rest/nets;q=149.20.4.15?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#

NetRange:       149.20.0.0 - 149.20.255.255
CIDR:           149.20.0.0/16
NetName:        ISC-NET3
NetHandle:      NET-149-20-0-0-1
Parent:         NET149 (NET-149-0-0-0-0)
NetType:        Direct Assignment
OriginAS:       
Organization:   Internet Systems Consortium, Inc. (ISC-94-Z)
RegDate:        1992-01-28
Updated:        2012-04-02
Ref:            https://whois.arin.net/rest/net/NET-149-20-0-0-1


OrgName:        Internet Systems Consortium, Inc.
OrgId:          ISC-94-Z
Address:        950 Charter Street
City:           Redwood City
StateProv:      CA
PostalCode:     94063
Country:        US
RegDate:        2007-11-08
Updated:        2015-11-05
Ref:            https://whois.arin.net/rest/org/ISC-94-Z


OrgAbuseHandle: ISCAT-ARIN
OrgAbuseName:   Internet Systems Consortium Abuse Team
OrgAbusePhone:  +1-650-423-1300 
OrgAbuseEmail:  abuse@isc.org
OrgAbuseRef:    https://whois.arin.net/rest/poc/ISCAT-ARIN

OrgNOCHandle: ISCN-ARIN
OrgNOCName:   Internet Systems Consortium NOC
OrgNOCPhone:  +1-650-423-1310 
OrgNOCEmail:  noc@isc.org
OrgNOCRef:    https://whois.arin.net/rest/poc/ISCN-ARIN

OrgTechHandle: ISCN-ARIN
OrgTechName:   Internet Systems Consortium NOC
OrgTechPhone:  +1-650-423-1310 
OrgTechEmail:  noc@isc.org
OrgTechRef:    https://whois.arin.net/rest/poc/ISCN-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml
#

seth · 2018-03-20 11:39:34

No. This is mirror-isc3.debian.org, nmap -p 1-1024 says

PORT     STATE  SERVICE
21/tcp   closed ftp
22/tcp   closed ssh
23/tcp   closed telnet
25/tcp   closed smtp
53/tcp   closed domain
80/tcp   open   http
110/tcp  closed pop3
113/tcp  closed ident
209/tcp  closed tam
256/tcp  closed fw1-secureremote
443/tcp  open   https
465/tcp  closed smtps
554/tcp  closed rtsp
587/tcp  closed submission
593/tcp  closed http-rpc-epmap
779/tcp  closed unknown
873/tcp  closed rsync
959/tcp  closed unknown
995/tcp  closed pop3s
1013/tcp closed unknown

so what does this server look like?

coolguy21 · 2018-03-20 15:22:09

Ok yes a webserver according to your scan.
I did the same scan and got different results.

$ nmap -p 1-1024 mirror-isc3.debian.org

Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-20 18:20 +03
Nmap scan report for mirror-isc3.debian.org (149.20.4.15)
Host is up (0.085s latency).

PORT     STATE    SERVICE
1/tcp    open     tcpmux
2/tcp    open     compressnet
3/tcp    open     compressnet
4/tcp    open     unknown
5/tcp    open     rje
6/tcp    open     unknown
7/tcp    open     echo
8/tcp    open     unknown
9/tcp    open     discard
10/tcp   open     unknown
11/tcp   open     systat
12/tcp   open     unknown
13/tcp   open     daytime
14/tcp   open     unknown
15/tcp   open     netstat
16/tcp   open     unknown
17/tcp   open     qotd
18/tcp   open     msp
19/tcp   open     chargen
20/tcp   open     ftp-data
21/tcp   filtered ftp
22/tcp   open     ssh
23/tcp   filtered telnet
24/tcp   open     priv-mail
25/tcp   filtered smtp
26/tcp   open     rsftp
27/tcp   open     nsw-fe
28/tcp   open     unknown
29/tcp   open     msg-icp
30/tcp   open     unknown
31/tcp   open     msg-auth
32/tcp   open     unknown
33/tcp   open     dsp
34/tcp   open     unknown
35/tcp   open     priv-print
36/tcp   open     unknown
37/tcp   open     time
38/tcp   open     rap
39/tcp   open     rlp
40/tcp   open     unknown
41/tcp   open     graphics
42/tcp   open     nameserver
43/tcp   open     whois
44/tcp   open     mpm-flags
45/tcp   open     mpm
46/tcp   open     mpm-snd
47/tcp   open     ni-ftp
48/tcp   open     auditd
49/tcp   open     tacacs
50/tcp   open     re-mail-ck
51/tcp   open     la-maint
52/tcp   open     xns-time
53/tcp   open     domain
54/tcp   open     xns-ch
55/tcp   open     isi-gl
56/tcp   open     xns-auth
57/tcp   open     priv-term
58/tcp   open     xns-mail
59/tcp   open     priv-file
60/tcp   open     unknown
61/tcp   open     ni-mail
62/tcp   open     acas
63/tcp   open     via-ftp
64/tcp   open     covia
65/tcp   open     tacacs-ds
66/tcp   open     sqlnet
67/tcp   open     dhcps
68/tcp   open     dhcpc
69/tcp   open     tftp
70/tcp   open     gopher
71/tcp   open     netrjs-1
72/tcp   open     netrjs-2
73/tcp   open     netrjs-3
74/tcp   open     netrjs-4
75/tcp   open     priv-dial
76/tcp   open     deos
77/tcp   open     priv-rje
78/tcp   open     vettcp
79/tcp   open     finger
80/tcp   open     http
81/tcp   open     hosts2-ns
82/tcp   open     xfer
83/tcp   open     mit-ml-dev
84/tcp   open     ctf
85/tcp   open     mit-ml-dev
86/tcp   open     mfcobol
87/tcp   open     priv-term-l
88/tcp   open     kerberos-sec
89/tcp   open     su-mit-tg
90/tcp   open     dnsix
91/tcp   open     mit-dov
92/tcp   open     npp
93/tcp   open     dcp
94/tcp   open     objcall
95/tcp   open     supdup
96/tcp   open     dixie
97/tcp   open     swift-rvf
98/tcp   open     linuxconf
99/tcp   open     metagram
100/tcp  open     newacct
101/tcp  open     hostname
102/tcp  open     iso-tsap
103/tcp  open     gppitnp
104/tcp  open     acr-nema
105/tcp  open     csnet-ns
106/tcp  open     pop3pw
107/tcp  open     rtelnet
108/tcp  open     snagas
109/tcp  open     pop2
110/tcp  filtered pop3
111/tcp  open     rpcbind
112/tcp  open     mcidas
113/tcp  open     ident
114/tcp  open     audionews
115/tcp  open     sftp
116/tcp  open     ansanotify
117/tcp  open     uucp-path
118/tcp  open     sqlserv
119/tcp  open     nntp
120/tcp  open     cfdptkt
121/tcp  open     erpc
122/tcp  open     smakynet
123/tcp  open     ntp
124/tcp  open     ansatrader
125/tcp  open     locus-map
126/tcp  open     unitary
127/tcp  open     locus-con
128/tcp  open     gss-xlicen
129/tcp  open     pwdgen
130/tcp  open     cisco-fna
131/tcp  open     cisco-tna
132/tcp  open     cisco-sys
133/tcp  open     statsrv
134/tcp  open     ingres-net
135/tcp  open     msrpc
136/tcp  open     profile
137/tcp  open     netbios-ns
138/tcp  open     netbios-dgm
139/tcp  open     netbios-ssn
140/tcp  open     emfis-data
141/tcp  open     emfis-cntl
142/tcp  open     bl-idm
143/tcp  filtered imap
144/tcp  open     news
145/tcp  open     uaac
146/tcp  open     iso-tp0
147/tcp  open     iso-ip
148/tcp  open     cronus
149/tcp  open     aed-512
150/tcp  open     sql-net
151/tcp  open     hems
152/tcp  open     bftp
153/tcp  open     sgmp
154/tcp  open     netsc-prod
155/tcp  open     netsc-dev
156/tcp  open     sqlsrv
157/tcp  open     knet-cmp
158/tcp  open     pcmail-srv
159/tcp  open     nss-routing
160/tcp  open     sgmp-traps
161/tcp  open     snmp
162/tcp  open     snmptrap
163/tcp  open     cmip-man
164/tcp  open     cmip-agent
165/tcp  open     xns-courier
166/tcp  open     s-net
167/tcp  open     namp
168/tcp  open     rsvd
169/tcp  open     send
170/tcp  open     print-srv
171/tcp  open     multiplex
172/tcp  open     cl-1
173/tcp  open     xyplex-mux
174/tcp  open     mailq
175/tcp  open     vmnet
176/tcp  open     genrad-mux
177/tcp  open     xdmcp
178/tcp  open     nextstep
179/tcp  open     bgp
180/tcp  open     ris
181/tcp  open     unify
182/tcp  open     audit
183/tcp  open     ocbinder
184/tcp  open     ocserver
185/tcp  open     remote-kis
186/tcp  open     kis
187/tcp  open     aci
188/tcp  open     mumps
189/tcp  open     qft
190/tcp  open     gacp
191/tcp  open     prospero
192/tcp  open     osu-nms
193/tcp  open     srmp
194/tcp  open     irc
195/tcp  open     dn6-nlm-aud
196/tcp  open     dn6-smm-red
197/tcp  open     dls
198/tcp  open     dls-mon
199/tcp  open     smux
200/tcp  open     src
201/tcp  open     at-rtmp
202/tcp  open     at-nbp
203/tcp  open     at-3
204/tcp  open     at-echo
205/tcp  open     at-5
206/tcp  open     at-zis
207/tcp  open     at-7
208/tcp  open     at-8
209/tcp  open     tam
210/tcp  open     z39.50
211/tcp  open     914c-g
212/tcp  open     anet
213/tcp  open     ipx
214/tcp  open     vmpwscs
215/tcp  open     softpc
216/tcp  open     atls
217/tcp  open     dbase
218/tcp  open     mpp
219/tcp  open     uarps
220/tcp  open     imap3
221/tcp  open     fln-spx
222/tcp  open     rsh-spx
223/tcp  open     cdc
224/tcp  open     masqdialer
225/tcp  open     unknown
226/tcp  open     unknown
227/tcp  open     unknown
228/tcp  open     unknown
229/tcp  open     unknown
230/tcp  open     unknown
231/tcp  open     unknown
232/tcp  open     unknown
233/tcp  open     unknown
234/tcp  open     unknown
235/tcp  open     unknown
236/tcp  open     unknown
237/tcp  open     unknown
238/tcp  open     unknown
239/tcp  open     unknown
240/tcp  open     unknown
241/tcp  open     unknown
242/tcp  open     direct
243/tcp  open     sur-meas
244/tcp  open     dayna
245/tcp  open     link
246/tcp  open     dsp3270
247/tcp  open     subntbcst_tftp
248/tcp  open     bhfhs
249/tcp  open     unknown
250/tcp  open     unknown
251/tcp  open     unknown
252/tcp  open     unknown
253/tcp  open     unknown
254/tcp  open     unknown
255/tcp  open     unknown
256/tcp  open     fw1-secureremote
257/tcp  open     fw1-mc-fwmodule
258/tcp  open     fw1-mc-gui
259/tcp  open     esro-gen
260/tcp  open     openport
261/tcp  open     nsiiops
262/tcp  open     arcisdms
263/tcp  open     hdap
264/tcp  open     bgmp
265/tcp  open     maybe-fw1
266/tcp  open     sst
267/tcp  open     td-service
268/tcp  open     td-replica
269/tcp  open     manet
270/tcp  open     gist
271/tcp  open     pt-tls
272/tcp  open     unknown
273/tcp  open     unknown
274/tcp  open     unknown
275/tcp  open     unknown
276/tcp  open     unknown
277/tcp  open     unknown
278/tcp  open     unknown
279/tcp  open     unknown
280/tcp  open     http-mgmt
281/tcp  open     personal-link
282/tcp  open     cableport-ax
283/tcp  open     rescap
284/tcp  open     corerjd
285/tcp  open     unknown
286/tcp  open     fxp
287/tcp  open     k-block
288/tcp  open     unknown
289/tcp  open     unknown
290/tcp  open     unknown
291/tcp  open     unknown
292/tcp  open     unknown
293/tcp  open     unknown
294/tcp  open     unknown
295/tcp  open     unknown
296/tcp  open     unknown
297/tcp  open     unknown
298/tcp  open     unknown
299/tcp  open     unknown
300/tcp  open     unknown
301/tcp  open     unknown
302/tcp  open     unknown
303/tcp  open     unknown
304/tcp  open     unknown
305/tcp  open     unknown
306/tcp  open     unknown
307/tcp  open     unknown
308/tcp  open     novastorbakcup
309/tcp  open     entrusttime
310/tcp  open     bhmds
311/tcp  open     asip-webadmin
312/tcp  open     vslmp
313/tcp  open     magenta-logic
314/tcp  open     opalis-robot
315/tcp  open     dpsi
316/tcp  open     decauth
317/tcp  open     zannet
318/tcp  open     pkix-timestamp
319/tcp  open     ptp-event
320/tcp  open     ptp-general
321/tcp  open     pip
322/tcp  open     rtsps
323/tcp  open     rpki-rtr
324/tcp  open     rpki-rtr-tls
325/tcp  open     unknown
326/tcp  open     unknown
327/tcp  open     unknown
328/tcp  open     unknown
329/tcp  open     unknown
330/tcp  open     unknown
331/tcp  open     unknown
332/tcp  open     unknown
333/tcp  open     texar
334/tcp  open     unknown
335/tcp  open     unknown
336/tcp  open     unknown
337/tcp  open     unknown
338/tcp  open     unknown
339/tcp  open     unknown
340/tcp  open     unknown
341/tcp  open     unknown
342/tcp  open     unknown
343/tcp  open     unknown
344/tcp  open     pdap
345/tcp  open     pawserv
346/tcp  open     zserv
347/tcp  open     fatserv
348/tcp  open     csi-sgwp
349/tcp  open     mftp
350/tcp  open     matip-type-a
351/tcp  open     matip-type-b
352/tcp  open     dtag-ste-sb
353/tcp  open     ndsauth
354/tcp  open     bh611
355/tcp  open     datex-asn
356/tcp  open     cloanto-net-1
357/tcp  open     bhevent
358/tcp  open     shrinkwrap
359/tcp  open     tenebris_nts
360/tcp  open     scoi2odialog
361/tcp  open     semantix
362/tcp  open     srssend
363/tcp  open     rsvp_tunnel
364/tcp  open     aurora-cmgr
365/tcp  open     dtk
366/tcp  open     odmr
367/tcp  open     mortgageware
368/tcp  open     qbikgdp
369/tcp  open     rpc2portmap
370/tcp  open     codaauth2
371/tcp  open     clearcase
372/tcp  open     ulistserv
373/tcp  open     legent-1
374/tcp  open     legent-2
375/tcp  open     hassle
376/tcp  open     nip
377/tcp  open     tnETOS
378/tcp  open     dsETOS
379/tcp  open     is99c
380/tcp  open     is99s
381/tcp  open     hp-collector
382/tcp  open     hp-managed-node
383/tcp  open     hp-alarm-mgr
384/tcp  open     arns
385/tcp  open     ibm-app
386/tcp  open     asa
387/tcp  open     aurp
388/tcp  open     unidata-ldm
389/tcp  open     ldap
390/tcp  open     uis
391/tcp  open     synotics-relay
392/tcp  open     synotics-broker
393/tcp  open     dis
394/tcp  open     embl-ndt
395/tcp  open     netcp
396/tcp  open     netware-ip
397/tcp  open     mptn
398/tcp  open     kryptolan
399/tcp  open     iso-tsap-c2
400/tcp  open     work-sol
401/tcp  open     ups
402/tcp  open     genie
403/tcp  open     decap
404/tcp  open     nced
405/tcp  open     ncld
406/tcp  open     imsp
407/tcp  open     timbuktu
408/tcp  open     prm-sm
409/tcp  open     prm-nm
410/tcp  open     decladebug
411/tcp  open     rmt
412/tcp  open     synoptics-trap
413/tcp  open     smsp
414/tcp  open     infoseek
415/tcp  open     bnet
416/tcp  open     silverplatter
417/tcp  open     onmux
418/tcp  open     hyper-g
419/tcp  open     ariel1
420/tcp  open     smpte
421/tcp  open     ariel2
422/tcp  open     ariel3
423/tcp  open     opc-job-start
424/tcp  open     opc-job-track
425/tcp  open     icad-el
426/tcp  open     smartsdp
427/tcp  open     svrloc
428/tcp  open     ocs_cmu
429/tcp  open     ocs_amu
430/tcp  open     utmpsd
431/tcp  open     utmpcd
432/tcp  open     iasd
433/tcp  open     nnsp
434/tcp  open     mobileip-agent
435/tcp  open     mobilip-mn
436/tcp  open     dna-cml
437/tcp  open     comscm
438/tcp  open     dsfgw
439/tcp  open     dasp
440/tcp  open     sgcp
441/tcp  open     decvms-sysmgt
442/tcp  open     cvc_hostd
443/tcp  filtered https
444/tcp  open     snpp
445/tcp  filtered microsoft-ds
446/tcp  open     ddm-rdb
447/tcp  open     ddm-dfm
448/tcp  open     ddm-ssl
449/tcp  open     as-servermap
450/tcp  open     tserver
451/tcp  open     sfs-smp-net
452/tcp  open     sfs-config
453/tcp  open     creativeserver
454/tcp  open     contentserver
455/tcp  open     creativepartnr
456/tcp  open     macon
457/tcp  open     scohelp
458/tcp  open     appleqtc
459/tcp  open     ampr-rcmd
460/tcp  open     skronk
461/tcp  open     datasurfsrv
462/tcp  open     datasurfsrvsec
463/tcp  open     alpes
464/tcp  open     kpasswd5
465/tcp  open     smtps
466/tcp  open     digital-vrc
467/tcp  open     mylex-mapd
468/tcp  open     photuris
469/tcp  open     rcp
470/tcp  open     scx-proxy
471/tcp  open     mondex
472/tcp  open     ljk-login
473/tcp  open     hybrid-pop
474/tcp  open     tn-tl-w1
475/tcp  open     tcpnethaspsrv
476/tcp  open     tn-tl-fd1
477/tcp  open     ss7ns
478/tcp  open     spsc
479/tcp  open     iafserver
480/tcp  open     loadsrv
481/tcp  open     dvs
482/tcp  open     bgs-nsi
483/tcp  open     ulpnet
484/tcp  open     integra-sme
485/tcp  open     powerburst
486/tcp  open     sstats
487/tcp  open     saft
488/tcp  open     gss-http
489/tcp  open     nest-protocol
490/tcp  open     micom-pfs
491/tcp  open     go-login
492/tcp  open     ticf-1
493/tcp  open     ticf-2
494/tcp  open     pov-ray
495/tcp  open     intecourier
496/tcp  open     pim-rp-disc
497/tcp  open     retrospect
498/tcp  open     siam
499/tcp  open     iso-ill
500/tcp  open     isakmp
501/tcp  open     stmf
502/tcp  open     mbap
503/tcp  open     intrinsa
504/tcp  open     citadel
505/tcp  open     mailbox-lm
506/tcp  open     ohimsrv
507/tcp  open     crs
508/tcp  open     xvttp
509/tcp  open     snare
510/tcp  open     fcp
511/tcp  open     passgo
512/tcp  open     exec
513/tcp  open     login
514/tcp  open     shell
515/tcp  open     printer
516/tcp  open     videotex
517/tcp  open     talk
518/tcp  open     ntalk
519/tcp  open     utime
520/tcp  open     efs
521/tcp  open     ripng
522/tcp  open     ulp
523/tcp  open     ibm-db2
524/tcp  open     ncp
525/tcp  open     timed
526/tcp  open     tempo
527/tcp  open     stx
528/tcp  open     custix
529/tcp  open     irc
530/tcp  open     courier
531/tcp  open     conference
532/tcp  open     netnews
533/tcp  open     netwall
534/tcp  open     mm-admin
535/tcp  open     iiop
536/tcp  open     opalis-rdv
537/tcp  open     nmsp
538/tcp  open     gdomap
539/tcp  open     apertus-ldp
540/tcp  open     uucp
541/tcp  open     uucp-rlogin
542/tcp  open     commerce
543/tcp  open     klogin
544/tcp  open     kshell
545/tcp  open     ekshell
546/tcp  open     dhcpv6-client
547/tcp  open     dhcpv6-server
548/tcp  open     afp
549/tcp  open     idfp
550/tcp  open     new-rwho
551/tcp  open     cybercash
552/tcp  open     deviceshare
553/tcp  open     pirp
554/tcp  open     rtsp
555/tcp  open     dsf
556/tcp  open     remotefs
557/tcp  open     openvms-sysipc
558/tcp  open     sdnskmp
559/tcp  open     teedtap
560/tcp  open     rmonitor
561/tcp  open     monitor
562/tcp  open     chshell
563/tcp  open     snews
564/tcp  open     9pfs
565/tcp  open     whoami
566/tcp  open     streettalk
567/tcp  open     banyan-rpc
568/tcp  open     ms-shuttle
569/tcp  open     ms-rome
570/tcp  open     meter
571/tcp  open     umeter
572/tcp  open     sonar
573/tcp  open     banyan-vip
574/tcp  open     ftp-agent
575/tcp  open     vemmi
576/tcp  open     ipcd
577/tcp  open     vnas
578/tcp  open     ipdd
579/tcp  open     decbsrv
580/tcp  open     sntp-heartbeat
581/tcp  open     bdp
582/tcp  open     scc-security
583/tcp  open     philips-vc
584/tcp  open     keyserver
585/tcp  open     imap4-ssl
586/tcp  open     password-chg
587/tcp  filtered submission
588/tcp  open     cal
589/tcp  open     eyelink
590/tcp  open     tns-cml
591/tcp  open     http-alt
592/tcp  open     eudora-set
593/tcp  open     http-rpc-epmap
594/tcp  open     tpip
595/tcp  open     cab-protocol
596/tcp  open     smsd
597/tcp  open     ptcnameservice
598/tcp  open     sco-websrvrmg3
599/tcp  open     acp
600/tcp  open     ipcserver
601/tcp  open     syslog-conn
602/tcp  open     xmlrpc-beep
603/tcp  open     mnotes
604/tcp  open     tunnel
605/tcp  open     soap-beep
606/tcp  open     urm
607/tcp  open     nqs
608/tcp  open     sift-uft
609/tcp  open     npmp-trap
610/tcp  open     npmp-local
611/tcp  open     npmp-gui
612/tcp  open     hmmp-ind
613/tcp  open     hmmp-op
614/tcp  open     sshell
615/tcp  open     sco-inetmgr
616/tcp  open     sco-sysmgr
617/tcp  open     sco-dtmgr
618/tcp  open     dei-icda
619/tcp  open     compaq-evm
620/tcp  open     sco-websrvrmgr
621/tcp  open     escp-ip
622/tcp  open     collaborator
623/tcp  open     oob-ws-http
624/tcp  open     cryptoadmin
625/tcp  open     apple-xsrvr-admin
626/tcp  open     apple-imap-admin
627/tcp  open     passgo-tivoli
628/tcp  open     qmqp
629/tcp  open     3com-amp3
630/tcp  open     rda
631/tcp  open     ipp
632/tcp  open     bmpp
633/tcp  open     servstat
634/tcp  open     ginad
635/tcp  open     rlzdbase
636/tcp  open     ldapssl
637/tcp  open     lanserver
638/tcp  open     mcns-sec
639/tcp  open     msdp
640/tcp  open     entrust-sps
641/tcp  open     repcmd
642/tcp  open     esro-emsdp
643/tcp  open     sanity
644/tcp  open     dwr
645/tcp  open     pssc
646/tcp  open     ldp
647/tcp  open     dhcp-failover
648/tcp  open     rrp
649/tcp  open     cadview-3d
650/tcp  open     obex
651/tcp  open     ieee-mms
652/tcp  open     hello-port
653/tcp  open     repscmd
654/tcp  open     aodv
655/tcp  open     tinc
656/tcp  open     spmp
657/tcp  open     rmc
658/tcp  open     tenfold
659/tcp  open     unknown
660/tcp  open     mac-srvr-admin
661/tcp  open     hap
662/tcp  open     pftp
663/tcp  open     purenoise
664/tcp  open     secure-aux-bus
665/tcp  open     sun-dr
666/tcp  open     doom
667/tcp  open     disclose
668/tcp  open     mecomm
669/tcp  open     meregister
670/tcp  open     vacdsm-sws
671/tcp  open     vacdsm-app
672/tcp  open     vpps-qua
673/tcp  open     cimplex
674/tcp  open     acap
675/tcp  open     dctp
676/tcp  open     vpps-via
677/tcp  open     vpp
678/tcp  open     ggf-ncp
679/tcp  open     mrm
680/tcp  open     entrust-aaas
681/tcp  open     entrust-aams
682/tcp  open     xfr
683/tcp  open     corba-iiop
684/tcp  open     corba-iiop-ssl
685/tcp  open     mdc-portmapper
686/tcp  open     hcp-wismar
687/tcp  open     asipregistry
688/tcp  open     realm-rusd
689/tcp  open     nmap
690/tcp  open     vatp
691/tcp  open     resvc
692/tcp  open     hyperwave-isp
693/tcp  open     connendp
694/tcp  open     ha-cluster
695/tcp  open     ieee-mms-ssl
696/tcp  open     rushd
697/tcp  open     uuidgen
698/tcp  open     olsr
699/tcp  open     accessnetwork
700/tcp  open     epp
701/tcp  open     lmp
702/tcp  open     iris-beep
703/tcp  open     unknown
704/tcp  open     elcsd
705/tcp  open     agentx
706/tcp  open     silc
707/tcp  open     borland-dsj
708/tcp  open     unknown
709/tcp  open     entrustmanager
710/tcp  open     entrust-ash
711/tcp  open     cisco-tdp
712/tcp  open     tbrpf
713/tcp  open     iris-xpc
714/tcp  open     iris-xpcs
715/tcp  open     iris-lwz
716/tcp  open     pana
717/tcp  open     unknown
718/tcp  open     unknown
719/tcp  open     unknown
720/tcp  open     unknown
721/tcp  open     unknown
722/tcp  open     unknown
723/tcp  open     omfs
724/tcp  open     unknown
725/tcp  open     unknown
726/tcp  open     unknown
727/tcp  open     unknown
728/tcp  open     unknown
729/tcp  open     netviewdm1
730/tcp  open     netviewdm2
731/tcp  open     netviewdm3
732/tcp  open     unknown
733/tcp  open     unknown
734/tcp  open     unknown
735/tcp  open     unknown
736/tcp  open     unknown
737/tcp  open     unknown
738/tcp  open     unknown
739/tcp  open     unknown
740/tcp  open     netcp
741/tcp  open     netgw
742/tcp  open     netrcs
743/tcp  open     unknown
744/tcp  open     flexlm
745/tcp  open     unknown
746/tcp  open     unknown
747/tcp  open     fujitsu-dev
748/tcp  open     ris-cm
749/tcp  open     kerberos-adm
750/tcp  open     kerberos
751/tcp  open     kerberos_master
752/tcp  open     qrh
753/tcp  open     rrh
754/tcp  open     krb_prop
755/tcp  open     unknown
756/tcp  open     unknown
757/tcp  open     unknown
758/tcp  open     nlogin
759/tcp  open     con
760/tcp  open     krbupdate
761/tcp  open     kpasswd
762/tcp  open     quotad
763/tcp  open     cycleserv
764/tcp  open     omserv
765/tcp  open     webster
766/tcp  open     unknown
767/tcp  open     phonebook
768/tcp  open     unknown
769/tcp  open     vid
770/tcp  open     cadlock
771/tcp  open     rtip
772/tcp  open     cycleserv2
773/tcp  open     submit
774/tcp  open     rpasswd
775/tcp  open     entomb
776/tcp  open     wpages
777/tcp  open     multiling-http
778/tcp  open     unknown
779/tcp  open     unknown
780/tcp  open     wpgs
781/tcp  open     hp-collector
782/tcp  open     hp-managed-node
783/tcp  open     spamassassin
784/tcp  open     unknown
785/tcp  open     unknown
786/tcp  open     concert
787/tcp  open     qsc
788/tcp  open     unknown
789/tcp  open     unknown
790/tcp  open     unknown
791/tcp  open     unknown
792/tcp  open     unknown
793/tcp  open     unknown
794/tcp  open     unknown
795/tcp  open     unknown
796/tcp  open     unknown
797/tcp  open     unknown
798/tcp  open     unknown
799/tcp  open     controlit
800/tcp  open     mdbs_daemon
801/tcp  open     device
802/tcp  open     mbap-s
803/tcp  open     unknown
804/tcp  open     unknown
805/tcp  open     unknown
806/tcp  open     unknown
807/tcp  open     unknown
808/tcp  open     ccproxy-http
809/tcp  open     unknown
810/tcp  open     fcp-udp
811/tcp  open     unknown
812/tcp  open     unknown
813/tcp  open     unknown
814/tcp  open     unknown
815/tcp  open     unknown
816/tcp  open     unknown
817/tcp  open     unknown
818/tcp  open     unknown
819/tcp  open     unknown
820/tcp  open     unknown
821/tcp  open     unknown
822/tcp  open     unknown
823/tcp  open     unknown
824/tcp  open     unknown
825/tcp  open     unknown
826/tcp  open     unknown
827/tcp  open     unknown
828/tcp  open     itm-mcell-s
829/tcp  open     pkix-3-ca-ra
830/tcp  open     netconf-ssh
831/tcp  open     netconf-beep
832/tcp  open     netconfsoaphttp
833/tcp  open     netconfsoapbeep
834/tcp  open     unknown
835/tcp  open     unknown
836/tcp  open     unknown
837/tcp  open     unknown
838/tcp  open     unknown
839/tcp  open     unknown
840/tcp  open     unknown
841/tcp  open     unknown
842/tcp  open     unknown
843/tcp  open     unknown
844/tcp  open     unknown
845/tcp  open     unknown
846/tcp  open     unknown
847/tcp  open     dhcp-failover2
848/tcp  open     gdoi
849/tcp  open     unknown
850/tcp  open     unknown
851/tcp  open     unknown
852/tcp  open     unknown
853/tcp  open     domain-s
854/tcp  open     dlep
855/tcp  open     unknown
856/tcp  open     unknown
857/tcp  open     unknown
858/tcp  open     unknown
859/tcp  open     unknown
860/tcp  open     iscsi
861/tcp  open     owamp-control
862/tcp  open     twamp-control
863/tcp  open     unknown
864/tcp  open     unknown
865/tcp  open     unknown
866/tcp  open     unknown
867/tcp  open     unknown
868/tcp  open     unknown
869/tcp  open     unknown
870/tcp  open     unknown
871/tcp  open     supfilesrv
872/tcp  open     unknown
873/tcp  open     rsync
874/tcp  open     unknown
875/tcp  open     unknown
876/tcp  open     unknown
877/tcp  open     unknown
878/tcp  open     unknown
879/tcp  open     unknown
880/tcp  open     unknown
881/tcp  open     unknown
882/tcp  open     unknown
883/tcp  open     unknown
884/tcp  open     unknown
885/tcp  open     unknown
886/tcp  open     iclcnet-locate
887/tcp  open     iclcnet_svinfo
888/tcp  open     accessbuilder
889/tcp  open     unknown
890/tcp  open     unknown
891/tcp  open     unknown
892/tcp  open     unknown
893/tcp  open     unknown
894/tcp  open     unknown
895/tcp  open     unknown
896/tcp  open     unknown
897/tcp  open     unknown
898/tcp  open     sun-manageconsole
899/tcp  open     unknown
900/tcp  open     omginitialrefs
901/tcp  open     samba-swat
902/tcp  open     iss-realsecure
903/tcp  open     iss-console-mgr
904/tcp  open     unknown
905/tcp  open     unknown
906/tcp  open     unknown
907/tcp  open     unknown
908/tcp  open     unknown
909/tcp  open     unknown
910/tcp  open     kink
911/tcp  open     xact-backup
912/tcp  open     apex-mesh
913/tcp  open     apex-edge
914/tcp  open     unknown
915/tcp  open     unknown
916/tcp  open     unknown
917/tcp  open     unknown
918/tcp  open     unknown
919/tcp  open     unknown
920/tcp  open     unknown
921/tcp  open     unknown
922/tcp  open     unknown
923/tcp  open     unknown
924/tcp  open     unknown
925/tcp  open     unknown
926/tcp  open     unknown
927/tcp  open     unknown
928/tcp  open     unknown
929/tcp  open     unknown
930/tcp  open     unknown
931/tcp  open     unknown
932/tcp  open     unknown
933/tcp  open     unknown
934/tcp  open     unknown
935/tcp  open     unknown
936/tcp  open     unknown
937/tcp  open     unknown
938/tcp  open     unknown
939/tcp  open     unknown
940/tcp  open     unknown
941/tcp  open     unknown
942/tcp  open     unknown
943/tcp  open     unknown
944/tcp  open     unknown
945/tcp  open     unknown
946/tcp  open     unknown
947/tcp  open     unknown
948/tcp  open     unknown
949/tcp  open     unknown
950/tcp  open     oftep-rpc
951/tcp  open     unknown
952/tcp  open     unknown
953/tcp  open     rndc
954/tcp  open     unknown
955/tcp  open     unknown
956/tcp  open     unknown
957/tcp  open     unknown
958/tcp  open     unknown
959/tcp  open     unknown
960/tcp  open     unknown
961/tcp  open     unknown
962/tcp  open     unknown
963/tcp  open     unknown
964/tcp  open     unknown
965/tcp  open     unknown
966/tcp  open     unknown
967/tcp  open     unknown
968/tcp  open     unknown
969/tcp  open     unknown
970/tcp  open     unknown
971/tcp  open     unknown
972/tcp  open     unknown
973/tcp  open     unknown
974/tcp  open     unknown
975/tcp  open     securenetpro-sensor
976/tcp  open     unknown
977/tcp  open     unknown
978/tcp  open     unknown
979/tcp  open     unknown
980/tcp  open     unknown
981/tcp  open     unknown
982/tcp  open     unknown
983/tcp  open     unknown
984/tcp  open     unknown
985/tcp  open     unknown
986/tcp  open     unknown
987/tcp  open     unknown
988/tcp  open     unknown
989/tcp  open     ftps-data
990/tcp  open     ftps
991/tcp  open     nas
992/tcp  open     telnets
993/tcp  open     imaps
994/tcp  open     ircs
995/tcp  filtered pop3s
996/tcp  open     xtreelic
997/tcp  open     maitrd
998/tcp  open     busboy
999/tcp  open     garcon
1000/tcp open     cadlock
1001/tcp open     webpush
1002/tcp open     windows-icfw
1003/tcp open     unknown
1004/tcp open     unknown
1005/tcp open     unknown
1006/tcp open     unknown
1007/tcp open     unknown
1008/tcp open     ufsd
1009/tcp open     unknown
1010/tcp open     surf
1011/tcp open     unknown
1012/tcp open     unknown
1013/tcp open     unknown
1014/tcp open     unknown
1015/tcp open     unknown
1016/tcp open     unknown
1017/tcp open     unknown
1018/tcp open     unknown
1019/tcp open     unknown
1020/tcp open     unknown
1021/tcp open     exp1
1022/tcp open     exp2
1023/tcp open     netvenuechat
1024/tcp open     kdm

seth · 2018-03-20 15:49:53

You're aware that this looks incredibly fishy? And is pretty much exclusive to you?
https://pentest-tools.com/network-vulne … nline-nmap

Check your routing.

loqs · 2018-03-20 16:13:07

coolguy21 wrote:

it's setpty not setpy. I don't know what application it is, only discovered it by popping up by my firewall asking for a connection.

Which firewall is this? Did the output of systemd-cgls not include an entry for setpty?

coolguy21 · 2018-03-20 17:44:35

@seth - yes you're right. How do I check my routing?
@loqs - yes it did.

So what is it I still don't understand.

# systemd-cgls | grep set
│   │ └─3582 grep set
  ├─setpty.service
  │ └─731 /bin/setpty

● setpty.service - Setpty Service
   Loaded: loaded (/usr/lib/systemd/system/setpty.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2018-03-20 18:35:01 +03; 2h 2min ago
 Main PID: 731 (setpty)
    Tasks: 1 (limit: 4915)
   Memory: 676.0K
   CGroup: /system.slice/setpty.service
           └─731 /bin/setpty

seth · 2018-03-20 19:04:27

Well, so there's an enabled "setpty" service .... you will have installed this somehow and it's apparently a debian thing (the mirror is just debian.org)
"ip route" would be a good start - since you're apparently trying to build a firewall(?) you should at least read https://wiki.archlinux.org/index.php/Ne … figuration

Trilby · 2018-03-20 19:11:17

So what's in the setpty.service file?

Arch Linux

#1 2018-03-19 23:08:48

what is /usr/bin/setpty ?

#2 2018-03-19 23:14:39

Re: what is /usr/bin/setpty ?

#3 2018-03-19 23:23:28

Re: what is /usr/bin/setpty ?

#4 2018-03-19 23:32:22

Re: what is /usr/bin/setpty ?

#5 2018-03-19 23:37:58

Re: what is /usr/bin/setpty ?

#6 2018-03-19 23:47:22

Re: what is /usr/bin/setpty ?

#7 2018-03-19 23:55:01

Re: what is /usr/bin/setpty ?

#8 2018-03-19 23:59:58

Re: what is /usr/bin/setpty ?

#9 2018-03-20 00:12:12

Re: what is /usr/bin/setpty ?

#10 2018-03-20 00:16:12

Re: what is /usr/bin/setpty ?

#11 2018-03-20 00:22:36

Re: what is /usr/bin/setpty ?

#12 2018-03-20 00:30:13

Re: what is /usr/bin/setpty ?

#13 2018-03-20 00:49:17

Re: what is /usr/bin/setpty ?

#14 2018-03-20 01:06:06

Re: what is /usr/bin/setpty ?

#15 2018-03-20 01:13:31

Re: what is /usr/bin/setpty ?

#16 2018-03-20 03:56:43

Re: what is /usr/bin/setpty ?

#17 2018-03-20 07:03:08

Re: what is /usr/bin/setpty ?

#18 2018-03-20 09:36:09

Re: what is /usr/bin/setpty ?

#19 2018-03-20 11:39:34

Re: what is /usr/bin/setpty ?

#20 2018-03-20 15:22:09

Re: what is /usr/bin/setpty ?

#21 2018-03-20 15:49:53

Re: what is /usr/bin/setpty ?

#22 2018-03-20 16:13:07

Re: what is /usr/bin/setpty ?

#23 2018-03-20 17:44:35

Re: what is /usr/bin/setpty ?

#24 2018-03-20 19:04:27

Re: what is /usr/bin/setpty ?

#25 2018-03-20 19:11:17

Re: what is /usr/bin/setpty ?

Board footer