CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Remote access

Port 10000: Webmin

Webmin server administration (IANA lists NDMP backup).

10000

How Webmin works

Remote access
browser:10000#%&@!x9? browser:10000#%&@!x9?

A browser sends an HTTP request to port 10000 and the Webmin server sends the page back. Everything is encrypted: someone on the path only sees unreadable bytes.

Transport
TCP · UDP
Exposure risk
8/10 high if reachable from the Internet
Encryption
EncryptedTLS or built-in crypto
IANA status
Assignedcommon use differs from the registry
Range
Registered (1024-49151)
Category
Remote access
01 Security

Is port 10000 dangerous?

Common attacks and weaknesses

  • Webmin backdoor (CVE-2019-15107) and RCE vulnerabilities give root.

How to secure it

  • Restrict to admin IPs and keep Webmin updated, or remove it.

Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.

02 Registry

IANA registry entries for port 10000

ServicePortTransportDescriptionReferenceUpdated
ndmp 10000 TCP, UDP Network Data Management Protocol - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 10000, and is it reachable?

Linux

sudo ss -ltnup 'sport = :10000'      # process listening on 10000
sudo lsof -nP -i :10000

macOS

sudo lsof -nP -i :10000

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 10000 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 10000
netstat -ano | findstr :10000

From another machine

nmap -p 10000 -sV <host>
sudo nmap -sU -p 10000 <host>
nc -zv <host> 10000

Block it in the firewall

sudo ufw deny 10000/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 10000" -Direction Inbound -LocalPort 10000 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 10000 used for?

Webmin server administration (IANA lists NDMP backup).

Is port 10000 TCP or UDP?

Port 10000 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 10000?

It is rated 8/10 (high) when exposed to the Internet. Webmin backdoor (CVE-2019-15107) and RCE vulnerabilities give root. Restrict to admin IPs and keep Webmin updated, or remove it.

How do I check if port 10000 is open?

On Linux run "ss -ltnup 'sport = :10000'", on macOS "lsof -nP -i :10000", and on Windows "netstat -ano | findstr :10000" to see the local process. From another machine, "nmap -p 10000 <host>" shows whether it is reachable.

05 Related
:22 SSH tcp · udp · sctp · moderate risk :3389 RDP tcp · udp · critical risk :23 Telnet tcp · udp · critical risk :5900 VNC tcp · udp · critical risk :5985 WinRM (HTTP) tcp · udp · high risk :5986 WinRM (HTTPS) tcp · udp · high risk :89 SU/MIT Telnet Gateway tcp · udp :107 Remote Telnet Service tcp · udp

Latest vulnerability news

All news