CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Network services

Port 135: MS RPC

Microsoft RPC endpoint mapper, used by DCOM, WMI and many Windows services.

epmapRPC Endpoint MapperDCOM
135

How MS RPC works

Network services
client:135bindendpoint client:135bindendpoint

The client sends a request to port 135 and the MS RPC service answers. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
8/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Well-known (0-1023)
Category
Network services
01 Security

Is port 135 dangerous?

Common attacks and weaknesses

  • Remote enumeration of RPC services.
  • Lateral movement with WMI and DCOM.
  • Historic worms (Blaster, MS03-026).

How to secure it

  • Block at the edge.
  • Restrict RPC between workstations with host firewalls.
02 Registry

IANA registry entries for port 135

ServicePortTransportDescriptionReferenceUpdated
epmap 135 TCP, UDP DCE endpoint resolution - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 135, and is it reachable?

Linux

sudo ss -ltnup 'sport = :135'      # process listening on 135
sudo lsof -nP -i :135

macOS

sudo lsof -nP -i :135

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 135 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 135
netstat -ano | findstr :135

From another machine

nmap -p 135 -sV <host>
sudo nmap -sU -p 135 <host>
nc -zv <host> 135

Block it in the firewall

sudo ufw deny 135/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 135" -Direction Inbound -LocalPort 135 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 135 used for?

Microsoft RPC endpoint mapper, used by DCOM, WMI and many Windows services.

Is port 135 TCP or UDP?

Port 135 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 135?

It is rated 8/10 (high) when exposed to the Internet. Remote enumeration of RPC services. Block at the edge.

How do I check if port 135 is open?

On Linux run "ss -ltnup 'sport = :135'", on macOS "lsof -nP -i :135", and on Windows "netstat -ano | findstr :135" to see the local process. From another machine, "nmap -p 135 <host>" shows whether it is reachable.

05 Related
:53 DNS tcp · udp · moderate risk :123 NTP udp · tcp · moderate risk :67 DHCP server udp · tcp · moderate risk :111 rpcbind tcp · udp · high risk :9100 Raw printing (JetDirect) tcp · udp · high risk :631 IPP / CUPS tcp · udp · high risk :5353 mDNS udp · tcp · moderate risk :5355 LLMNR udp · tcp · high risk

Latest vulnerability news

All news