2

I am performing a network vulnerability scan of an Android Automotive platform. My setup consists of a Kali Linux machine and an Android Automotive Infotainment System on a local network. During the scanning, I found that port 5151 is open and is being used by a service named esri_sde.

kali:~$ sudo nmap -T4 -p- 192.168.x.x     //IP for infotainment system
Nmap scan report for 192.168.x.x
PORT     STATE SERVICE
5151/tcp open  esri_sde

Doing a netcat on the port 5151 for listening, provides me continuous data which is not human readable.

kali:~$ nc 192.168.x.x 5151
7ò”°R YJøOæݽ9^çÆC€E†éúaI™íÐåY—
...

I am not familiar with ESRI SDE or related services. Can anyone tell me how I can read this data on my Kali Machine. For eg. saving it to a file and reading it via some editor, or having some kind of SDE client on my Linux machine that can read the data being produced on port 5151.

Improve this question
7
  • As far as I know, the esri_sde service was phased out years ago. Currently, all connections from ArcGIS to a database (should) use native database connections.
    – Berend
    Jan 27, 2021 at 9:02
  • The infotainment system consists of the following Android build: android-10.0.0_r20. My first guess is that Android Auto is still using this service, or masking a newer version with old information
    – gst
    Jan 27, 2021 at 9:14
  • @Berend : can you help me understand what this stream of data on port 5151 is? What is exactly being published on the open port?
    – gst
    Jan 27, 2021 at 10:50
  • 2
    The esri_sde service was used to enable communication from an ArcGIS client (for instance ArcMap) to an SDE database (a database containing geographical features). This way, a client wouldn't need to have a specific database driver installed (e.g. for Oracle, SQL Server, etc), but only an SDE client. The stream would typically include requests to the database, which result in a number of records. Given the fact that Automotive is relatively new, I doubth if it uses the sde protocol, but who knows. It seems to be open source, so you could try to find references to esri or sde libraries
    – Berend
    Jan 27, 2021 at 11:33
  • Are you saying that Kali Linux has found port 5151 open and "Sending data", and has identified it as esri_sde? Like is it responding as esri_sde, or has Kali just found port 5151 and via some baked in logic it says 5151 is esri_sde -- meaning Kali might be assuming what's on 5151 is incorrect.
    – KHibma
    Jan 27, 2021 at 12:49

2 Answers 2

Reset to default
4

While Esri registered port 5151 for use of the now-deprecated ArcSDE application service, that doesn't mean your server has an ArcSDE service running on port 5151. It could only be an Esri application server if you licensed and deployed the software (it would have to be elderly software, since 10.2 and beyond don't support the network protocol, and 10.3 and earlier are no longer supported). There is nothing preventing any other application from running on that same port, and since the port is registered to 'esri_sde', network scanners would just assume that it was an Esri service.

An Esri application server only communicates with clients that fashion an appropriate connection request, which would have to be authenticated against an RDBMS like Oracle, PostgreSQL, Informix, or DB2. Failure to provide a properly formatted connection request (which is undocumented) would generate an error message and network session closure, not an indefinite stream of data. This makes me think you have other than Esri software running on that port.

The are ways within Linux to determine which binary is running on a port, but GIS SE isn't the right Stack for that question.

Improve this answer
0

After a bit more digging, I found out that the service might be actually this android.car.cluster.

console:/ # netstat -ltpu                                                  
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program Name
tcp6       0      0 :::pcrd                 :::*                    LISTEN      4473/android.car.cluster

I need to find a way to read this data now.

Improve this answer
1
  • 1
    So that probably is NOT Esri data. You may want to redirect your search to the general StackOverflow or android.stackexchange.com -- Further to my previous statements, IANA seems to think that port 5151 is esri_sde - Maybe Kali Linux has this assumption baked in.
    – KHibma
    Jan 28, 2021 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.