Common Ports and Services
Last updated
Was this helpful?
Last updated
Was this helpful?
I will try to make this chapter into a reference library. So that you can just check in this chapter to see common ways to exploit certain common services. I will only discuss the most common, since there are quite a few.
This is fucking awesome. if there is any ports here you dont find check out this guide.
If you have a port open with unkown service you can do this to find out which service it might be.
Connect to the ftp-server to enumerate software and version
Many ftp-servers allow anonymous users. These might be misconfigured and give too much access, and it might also be necessary for certain exploits to work. So always try to log in with anonymous:anonymous.
Remember the binary and ascii mode!
If you upload a binary file you have to put the ftp-server in binary mode, otherwise the file will become corrupted and you will not be able to use it! The same for text-files. Use ascii mode for them! You just write binary and ascii to switch mode.
SSH is such an old and fundamental technology so most modern version are quite hardened. You can find out the version of the SSH either but scanning it with nmap or by connecting with it using nc.
It returnes something like this: SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu1
Telnet is considered insecure mainly because it does not encrypt its traffic. Also a quick search in exploit-db will show that there are various RCE-vulnerabilities on different versions. Might be worth checking out.
Brute force it
You can also brute force it like this:
SMTP is a server to server service. The user receives or sends emails using IMAP or POP3. Those messages are then routed to the SMTP-server which communicates the email to another server. The SMTP-server has a database with all emails that can receive or send emails. We can use SMTP to query that database for possible email-addresses. Notice that we cannot retrieve any emails from SMTP. We can only send emails.
Here are the possible commands
We can use this service to find out which usernames are in the database. This can be done in the following way.
Here we have managed to identify the user root. But roooooot was rejected.
VRFY, EXPN and RCPT can be used to identify users.
Telnet is a bit more friendly some times. So always use that too
This process can of course be automatized
Check for commands
smtp-user-enum
The command will look like this. -M for mode. -U for userlist. -t for target
Metasploit
I can also be done using metasploit
This is a ftp-server but it is using UDP.
Info about web-vulnerabilities can be found in the next chapter HTTP - Web Vulnerabilities.
We usually just think of vulnerabilities on the http-interface, the web page, when we think of port 80. But with .htaccess we are able to password protect certain directories. If that is the case we can brute force that the following way.
Step 1
Create a directory that you want to password-protect. Create .htaccess tile inside that directory. Content of .htaccess:
Create .htpasswd file
This will now create a file called .htpasswd with the user: test and the password: admin
If the directory does not display a login-prompt, you might have to change the apache2.conf file. To this:
Now that we know how this works we can try to brute force it with medusa.
Kerberos is a protocol that is used for network authentication. Different versions are used by *nix and Windows. But if you see a machine with port 88 open you can be fairly certain that it is a Windows Domain Controller.
If you already have a login to a user of that domain you might be able to escalate that privilege.
Check out: MS14-068
This service is used for fetching emails on a email server. So the server that has this port open is probably an email-server, and other clients on the network (or outside) access this server to fetch their emails.
RFC: 1833
Rpcbind can help us look for NFS-shares. So look out for nfs. Obtain list of services running with RPC:
Network time protocol. It is used synchronize time. If a machine is running this server it might work as a server for synchronizing time. So other machines query this machine for the exact time.
An attacker could use this to change the time. Which might cause denial of service and all around havoc.
Samba is a service that enables the user to share files with other machines. It has interoperatibility, which means that it can share stuff between linux and windows systems. A windows user will just see an icon for a folder that contains some files. Even though the folder and files really exists on a linux-server.
If you don't provide any password, just click enter, the server might show you the different shares and version of the server. This can be useful information for looking for exploits. There are tons of exploits for smb.
So smb, for a linux-user, is pretty much like and ftp or a nfs.
If you have credentials you can use psexec you easily log in. You can either use the standalone binary or the metasploit module.
Scanning for smb with Nmap
There are several NSE scripts that can be useful, for example:
It can be a bit buggy sometimes so run it several times to make sure it found all users.
Enum4linux can be used to enumerate windows and linux machines with smb-shares.
The do all option:
You can also use rpcclient to enumerate the share.
Connect with a null-session. That is, without a user. This only works for older windows servers.
Once connected you could enter commands like
IMAP lets you access email stored on that server. So imagine that you are on a network at work, the emails you recieve is not stored on your computer but on a specific mail-server. So every time you look in your inbox your email-client (like outlook) fetches the emails from the mail-server using imap.
IMAP is a lot like pop3. But with IMAP you can access your email from various devices. With pop3 you can only access them from one device.
Port 993 is the secure port for IMAP.
Simple Network Management Protocol
SNMP protocols 1,2 and 2c does not encrypt its traffic. So it can be intercepted to steal credentials.
SNMP is used to manage devices on a network. It has some funny terminology. For example, instead of using the word password the word community is used instead. But it is kind of the same thing. A common community-string/password is public.
You can have read-only access to the snmp.Often just with the community string public.
Common community strings
SNMP stores all teh data in the Management Information Base. The MIB is a database that is organized as a tree. Different branches contains different information. So one branch can be username information, and another can be processes running. The "leaf" or the endpoint is the actual data. If you have read-access to the database you can read through each endpoint in the tree. This can be used with snmpwalk. It walks through the whole database tree and outputs the content.
snmpwalk
This command will output a lot of information. Way to much, and most of it will not be relevant to us and much we won't understand really. So it is better to request the info that you are interested in. Here are the locations of the stuff that we are interested in:
Now we can use this to query the data we really want.
snmpenum
snmp-check
This is a bit easier to use and with a lot prettier output.
Since SNMP is using UDP we have to use the -sU flag.
With onesixtyone you can test for open ports but also brute force community strings. I have had more success using onesixtyone than using nmap. So better use both.
There are a few snmp modules in metasploit that you can use. snmp_enum can show you usernames, services, and other stuff.
Lightweight Directory Access Protocol. This port is usually used for Directories. Directory her means more like a telephone-directory rather than a folder. Ldap directory can be understood a bit like the windows registry. A database-tree. Ldap is sometimes used to store usersinformation. Ldap is used more often in corporate structure. Webapplications can use ldap for authentication. If that is the case it is possible to perform ldap-injections which are similar to sqlinjections.
You can sometimes access the ldap using a anonymous login, or with other words no session. This can be useful becasue you might find some valuable data, about users.
When a client connects to the Ldap directory it can use it to query data, or add or remove.
Port 636 is used for SSL.
There are also metasploit modules for Windows 2000 SP4 and Windows Xp SP0/SP1
Okay this is only here as a reminder to always check for SSL-vulnerabilities such as heartbleed. For more on how to exploit web-applications check out the chapter on client-side vulnerabilities.
OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable OpenSSL 1.0.1g is NOT vulnerable OpenSSL 1.0.0 branch is NOT vulnerable OpenSSL 0.9.8 branch is NOT vulnerable
We can do that the following way.
or using a nmap script
You can exploit the vulnerability in many different ways. There is a module for it in burp suite, and metasploit also has a module for it.
Now you have a flow of random data, some of it might be of interest to you.
Read the certificate.
Does it include names that might be useful?
Correct vhost
RTSP (Real Time Streaming Protocol) is a stateful protocol built on top of tcp usually used for streaming images. Many commercial IP-cameras are running on this port. They often have a GUI interface, so look out for that.
Outgoing smtp-port
You authenticate with the OS-users.
There are vulnerabilities for it so check your searchsploit.
The default port for the Imap-protocol.
Port 995 is the default port for the Post Office Protocol. The protocol is used for clients to connect to the server and download their emails locally. You usually see this port open on mx-servers. Servers that are meant to send and recieve email.
Related ports: 110 is the POP3 non-encrypted.
25, 465
I have seen them open on windows machine. But nothing has been listening on it.
I think these are used by the RPC within Windows Domains. I have found no use for them so far. But they might indicate that the target is part of a Windows domain. Not sure though.
Default port for Microsoft SQL .
Many o the scanning modules in metasploit requires authentication. But some do not.
If you have credencials look in metasploit for other modules.
Enumeration
Bruteforce the ISD
Connect to the database with sqlplus
References:
These are also ports used by oracle on windows. They run Oracles Intelligent Agent.
Network file system This is a service used so that people can access certain parts of a remote filesystem. If this is badly configured it could mean that you grant excessive access to users.
If the service is on its default port you can run this command to see what the filesystem is sharing
Then you can mount the filesystem to your machine using the following command
Now we can go to /tmp/NFS and check out /etc/passwd, and add and remove files.
This can be used to escalate privileges if it is not correct configured. Check chapter on Linux Privilege Escalation.
There are some exploits for this, so check it out. You can use the default Oracle users to access to it. You can use the normal ftp protocol to access it.
Default logins: sys:sys scott:tiger
Always test the following:
Username: root
Password: root
You will most likely see this a lot:
This occurs because mysql is configured so that the root user is only allowed to log in from 127.0.0.1. This is a reasonable security measure put up to protect the database.
If mysql is started as root you might have a chance to use it as a way to escalate your privileges.
MYSQL UDF INJECTION:
You might gain access to a shell by uploading a reverse-shell. And then you need to escalate your privilege. One way to do that is to look into the databse and see what users and passwords that are available. Maybe someone is resuing a password?
So the first step is to find the login-credencials for the database. Those are usually found in some configuration-file oon the web-server. For example, in joomla they are found in:
In that file you find the
This is a proprietary protocol developed by windows to allow remote desktop.
Log in like this
Brute force like this
This is categorized by microsoft as a RCE vulnerability. But there is no POC for it online. You can only DOS a machine using this exploit.
I have not found anything here. Try connecting with netcat and visiting in browser.
I have seen this port being used by Apache James Remote Configuration.
There is an exploit for version 2.3.2
Windows Remote Management Service
The Distributed File System Replication (DFSR) service is a state-based, multi-master file replication engine that automatically copies updates to files and folders between computers that are participating in a common replication group. DFSR was added in Windows Server 2003 R2.
I am not sure how what can be done with this port. But if it is open it is a sign that the machine in question might be a Domain Controller.
VNC is used to get a screen for a remote host. But some of them have some exploits.
You can use vncviewer to connect to a vnc-service. Vncviewer comes built-in in Kali.
It defaults to port 5900. You do not have to set a username. VNC is run as a specific user, so when you use VNC it assumes that user. Also note that the password is not the user password on the machine. If you have dumped and cracked the user password on a machine does not mean you can use them to log in. To find the VNC password you can use the metasploit/meterpreter post exploit module that dumps VNC passwords
If you are unable to input ctr-alt-del (kali might interpret it as input for kali).
Try shift-ctr-alt-del
You can scan VNC for logins, with bruteforce.
Login scan
Scan for no-auth
Since this port is used by many different services. They are divided like this.
Tomcat suffers from default passwords. There is even a module in metasploit that enumerates common tomcat passwords. And another module for exploiting it and giving you a shell.
Active Directory Administrative Center is installed by default on Windows Server 2008 R2 and is available on Windows 7 when you install the Remote Server Administration Tools (RSAT).
This banner is defined in RFC4253, in chapter 4.2 Protocol Version Exchange. The protocol-version string should be defined like this: SSH-protoversion-softwareversion SP comments CR LF Where comments is optional. And SP means space, and CR (carriege return) and LF (Line feed) So basically the comments should be separated by a space.
Here are the documentations for SMTP
This is the windows rpc-port.
Here is a good guide for how to configure samba:
For info about it ere:
Here is a longer list of common community strings:
First we need to investigate if the https-page is vulnerable to
If Postfix is run on it it could be vunerable to shellshock
Common UNIX Printing System has become the standard for sharing printers on a linux-network. You will often see port 631 open in your priv-esc enumeration when you run netstat. You can log in to it here:
Find version. Test cups-config --version. If this does not work surf to and see the CUPS version in the title bar of your browser.
Can be accessed through ftp. Some default passwords here: Name: Version:
