Common attacks and weaknesses
- Connections to 4444 often mean a reverse shell or a pentest tool; worms like Blaster used it too.
Port 4444: Metasploit default / krb524
Registered for krb524, but best known as the default Metasploit listener port.
4444
How Metasploit default / krb524 works
Other servicesThe client sends a request to port 4444 and the Metasploit default / krb524 service answers. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 8/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- Other services
Is port 4444 dangerous?
How to secure it
- Alert on unexpected inbound or outbound traffic to 4444.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 4444
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| krb524 | 4444 | TCP, UDP | KRB524 Reported: krb524 assigned the port, nv used it without an assignment | - | - |
| nv-video | 4444 | TCP, UDP | NV Video default Reported: krb524 assigned the port, nv used it without an assignment | - | - |
// source: IANA service name and port number registry
Which program uses port 4444, and is it reachable?
Linux
sudo ss -ltnup 'sport = :4444' # process listening on 4444
sudo lsof -nP -i :4444macOS
sudo lsof -nP -i :4444
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 4444 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 4444 netstat -ano | findstr :4444
From another machine
nmap -p 4444 -sV <host> sudo nmap -sU -p 4444 <host> nc -zv <host> 4444
Block it in the firewall
sudo ufw deny 4444/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 4444" -Direction Inbound -LocalPort 4444 -Protocol TCP -Action Block # Windows
What is port 4444 used for?
Registered for krb524, but best known as the default Metasploit listener port.
Is port 4444 TCP or UDP?
Port 4444 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 4444?
It is rated 8/10 (high) when exposed to the Internet. Connections to 4444 often mean a reverse shell or a pentest tool; worms like Blaster used it too. Alert on unexpected inbound or outbound traffic to 4444.
How do I check if port 4444 is open?
On Linux run "ss -ltnup 'sport = :4444'", on macOS "lsof -nP -i :4444", and on Windows "netstat -ano | findstr :4444" to see the local process. From another machine, "nmap -p 4444 <host>" shows whether it is reachable.