常见端口及其脆弱点¶
Common Ports List¶
| Port Number | Service/Protocol | Description |
|---|---|---|
| 21 | FTP | File Transfer Protocol |
| 22 | SSH | Secure Shell |
| 23 | Telnet | Unencrypted text communications |
| 25 | SMTP | Simple Mail Transfer Protocol |
| 53 | DNS | Domain Name System |
| 80 | HTTP | Hypertext Transfer Protocol |
| 110 | POP3 | Post Office Protocol v3 |
| 111 | RPCbind/SunRPC | Remote Procedure Call |
| 135 | Windows RPC | Microsoft RPC |
| 137-139 | NetBIOS over TCP/IP | Network Basic Input/Output System |
| 143 | IMAP | Internet Message Access Protocol |
| 161 | SNMP | Simple Network Management Protocol |
| 443 | HTTPS | Hypertext Transfer Protocol Secure |
| 445 | Microsoft-DS/SMB | Server Message Block |
| 465 | SMTPS | Secure SMTP |
| 514 | Syslog | System Logging Protocol |
| 993 | IMAPS | Secure IMAP |
| 995 | POP3S | Secure POP3 |
| 1025 | NFS/Microsoft RPC | Network File System or Microsoft RPC |
| 1080 | SOCKS Proxy | SOCKet Secure Proxy |
| 1433 | Microsoft SQL Server | Microsoft SQL Database |
| 1434 | Microsoft SQL Monitor | SQL Server Resolution Service |
| 1521 | Oracle Database | Oracle Database Server |
| 1723 | PPTP | Point-to-Point Tunneling Protocol |
| 2049 | NFS | Network File System |
| 2082 | cPanel | cPanel Control Panel |
| 2083 | cPanel over SSL | Secure cPanel |
| 3128 | Squid Proxy | Squid Caching Proxy |
| 3306 | MySQL | MySQL Database Server |
| 3389 | RDP | Remote Desktop Protocol |
| 5432 | PostgreSQL | PostgreSQL Database Server |
| 5900 | VNC | Virtual Network Computing |
| 5938 | TeamViewer | Remote Control Application |
| 6379 | Redis | Redis NoSQL Database |
| 8080 | HTTP Proxy/Alternative HTTP | Alternative HTTP Proxy Server |
| 8443 | Plesk Control Panel | Plesk Web Hosting Control Panel |
| 8888 | Alternate HTTP | Alternate HTTP Port |
| 9200 | Elasticsearch | Elasticsearch Search and Analytics Engine |
| 10000 | Webmin | Webmin Web-Based Interface for System Administration |
| 27017 | MongoDB | MongoDB NoSQL Database |
| 3074 | Xbox Live | Xbox Live Gaming |
| 5060 | SIP | Session Initiation Protocol |
| 135 | RPC | Remote Procedure Call |
| 139 | NetBIOS | Network Basic Input/Output System |
| 1433 | MSSQL | Microsoft SQL Server |
| 1521 | Oracle | Oracle Database Server |
| 1723 | PPTP | Point-to-Point Tunneling Protocol |
| 1900 | UPnP | Universal Plug and Play |
| 2302 | DayZ | DayZ Game Server |
| 4000 | Elasticsearch | Elasticsearch Search and Analytics Engine |
| 4444 | Metasploit | Metasploit Framework |
| 5000 | Python Flask | Python Flask Development Server |
| 5555 | Android Debug Bridge | Android Debug Bridge (ADB) |
| 6667 | IRC | Internet Relay Chat |
| 6697 | IRC SSL | Secure Internet Relay Chat |
| 8000 | HTTP Alt | Alternate HTTP Port |
| 8081 | HTTP Proxy | Alternative HTTP Proxy |
| 9100 | Printer | Network Printer |
| 9090 | Web Debugging | Web Debugging Interface |
| 5985/5986 | WinRM | Windows Remote Management |
| 28017 | MongoDB HTTP Interface | MongoDB HTTP Interface |
Attack¶
FTP (21/TCP)¶
- 匿名登录
-
暴力破解密码
-
VSFTP某版本后门
SSH (22/TCP)¶
- 部分版本SSH存在漏洞可枚举用户名
- 暴力破解密码
Telent (23/TCP)¶
- 暴力破解密码
- 嗅探抓取明文密码
SMTP (25/TCP)¶
- 无认证时可伪造发件人
DNS (53/UDP & 53/TCP)¶
- 域传送漏洞
- DNS劫持
- DNS缓存投毒
-
DNS欺骗
-
SPF / DMARC Check
- DDoS
- DNS Query Flood
-
DNS 反弹
-
DNS 隧道
DHCP 67/68¶
- 劫持/欺骗
TFTP (69/TCP)¶
HTTP (80/TCP)¶
- 明文传输
- 中间人攻击
Kerberos (88/TCP)¶
- 主要用于监听KDC的票据请求
- 用于进行黄金票据和白银票据的伪造
- 重放攻击
POP3 (110/TCP & 995/TCP)¶
- 爆破
RPC (135/TCP)¶
- wmic 服务利用
NetBIOS (137/UDP & 138/UDP)¶
- 未授权访问
- 弱口令
NetBIOS / Samba (139/TCP)¶
- 未授权访问
- 弱口令
IMAP (143/TCP & 993/TCP)¶
SNMP (161/TCP & 161/UDP)¶
- Public 弱口令
LDAP (389/TCP)¶
- 用于域上的权限验证服务
- 匿名访问
- 注入
HTTPS (443/TCP)¶
SMB (445/TCP)¶
Windows 协议簇，主要功能为文件共享服务
Linux Rexec (512/TCP & 513/TCP & 514/TCP)¶
- 弱口令
Rsync (873/TCP)¶
- 未授权访问
RPC (1025/TCP)¶
- NFS匿名访问
Java RMI (1090/TCP & 1099/TCP)¶
- 反序列化远程命令执行漏洞
MSSQL (1433/TCP)¶
- 弱密码
- 差异备份 GetShell
- SA 提权
Oracle (1521/TCP)¶
- 弱密码
NFS (2049/TCP)¶
- 权限设置不当
ZooKeeper (2171/TCP & 2375/TCP)¶
- 无身份认证
Docker Remote API (2375/TCP)¶
- 未限制IP / 未启用TLS身份认证
MySQL (3306/TCP)¶
-
弱密码
-
日志写WebShell
- UDF提权
- MOF提权
RDP / Terminal Services (3389/TCP)¶
- 弱密码
Postgres (5432/TCP)¶
- 弱密码
- 执行系统命令
- VNC (5900/TCP)
CouchDB (5984/TCP)¶
- 未授权访问
WinRM (5985/TCP)¶
- Windows对WS-Management的实现
- 在Vista上需要手动启动，在Windows Server 2008中服务是默认开启的
Redis (6379/TCP)¶
- 无密码或弱密码
- 绝对路径写 WebShell
- 计划任务反弹 Shell
- 写 SSH 公钥
-
主从复制 RCE
-
Windows 写启动项
Kubernetes API Server (6443/TCP && 10250/TCP)¶
JDWP (8000/TCP)¶
- 远程命令执行
ActiveMQ (8061/TCP)¶
Jenkin (8080/TCP)¶
- 未授权访问
Elasticsearch (9200/TCP)¶
- 代码执行
Memcached (11211/TCP & 11211/UDP)¶
- 未授权访问
RabbitMQ (15672/TCP & 15692/TCP & 25672/TCP)¶
MongoDB (27017/TCP)¶
- 无密码或弱密码
Hadoop (50070/TCP & 50075/TCP)¶
- 未授权访问
参考链接:
https://paper.seebug.org/409/#92
https://mp.weixin.qq.com/s/aatNjey3swZz7T4Yw_LqsQ
https://mp.weixin.qq.com/s/dqntjRLgcOD3D2bi1oDFAw
All Ports¶
https://speedguide.net/ports.php?filter=risk&sort=&p=0