Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was running a vulnerability scan against a Windows Server of mine, TCP port 135. I got the following output:

By sending a Lookup request to the portmapper TCP 135 it was possible to enumerate the Distributed Computing Environment services running on the remote port. Using this information it is possible to connect and bind to each service by sending an RPC request to the remote port/pipe.

So now I have the following questions:

  • How can someone connect and bind to each service? What is the command/tool to use, and does it require authentication?
  • What are the security risks of having this service running, if any?
share|improve this question
1  
you need to authenticate in order to get information from services via RPC. –  YSY Oct 7 '11 at 12:41
6  
Older versions of Windows allowed null enumeration--collection of possibly dangerous information about the server without authenticating. sheetaljoseph.org/scribblings/enumeration.pdf is a decent overview of the dangers from that era. –  user502 Oct 7 '11 at 13:13
1  
@user502 - your comment should be an answer. –  Rory Alsop Oct 7 '11 at 13:51
2  
That did sorta cross the information-content threshhold for a full answer. Unfortunately, it was wrong--139 and 445 were the null enum risks on pre-Windows XP SP2 and Windows 2003 SP1 systems. DCE/RPC endpoint mapping is different, it'll give you information like this: offensive-security.com/metasploit-unleashed/… –  user502 Oct 7 '11 at 14:26

1 Answer 1

up vote 2 down vote accepted
+50
  • How can someone connect and bind to each service? What is the command/tool to use, and does it require authentication?

The net use command, browsing network shares, or any other SMB-related command will make use of these services.

  • What are the security risks of having this service running, if any?

It's often a necessary service to have running as it provides the backbone of a great deal of Windows network sharing services. I wouldn't be concerned so much on it running as I would be concerned if it were exposed outside your network. I believe service enumeration and possible undocumented exploits are the two current risks. Because this is a remote procedure call service, it does have some of the same excitement as any application service -- think of requests passed there in terms of a web query. They ask for a service (page) and pass certain relevant parameters (GET or POST options). Something on the service's back-end runs and returns a result.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.