Port Audit: What's Open, What's Exposed, What Shouldn't Be

A box handed to you for review is running services you didn't install. Before it ships you answer the question every audit starts with: what is actually listening, and what is reachable from the network?

Three artifacts are in /root/case/:

• scan.txt — a TCP connect scan of 127.0.0.1 (the exact nc one-liner that produced it is in the file's header — the port scan every operator should know).
• listeners.txt — ss -tlnp on the box: every LISTEN socket, its bind address, and the owning process.
• baseline.txt — the services this host is supposed to run.

Record three findings:

1. /root/case/open_ports.txt — every open TCP port the scan found, one port number per line.

2. /root/case/exposed_ports.txt — the subset that is actually reachable from the network: bound to 0.0.0.0 (all interfaces), NOT 127.0.0.1 (loopback only). "Open in a localhost scan" is not the same as "exposed" — a loopback-bound service refuses every remote connection. This distinction IS the audit.

3. /root/case/rogue.txt — the port that is exposed but is NOT in the baseline: an unexpected listener on a public interface. That is your finding.

The fix (bind it down or kill it) is out of scope — this lab grades the enumeration.