I know that remote code execution depends on the service running on the open port.
For example I know that SSH, FTP may be vulnerable to RCE if they are running an unpatched version.
So what about other ports? What ports can be also vulnerable to this attack and may allow me to get RCE?

  • 5
    I believe this question is too broad. Any port with a service listening on it can potentially be vulnerable to RCE, but I doubt you want the answer to be "ports 1 through 65535, TCP and UDP". – forest Aug 6 '18 at 22:51
  • Thanks for response What i meant is what if i see servcie like POP3 , MYSQL listening in the remote device ? could this ports allow me to get RCE ? – Tarek Zidan Aug 6 '18 at 23:12
  • 1
    That depends on if the services are vulnerable. There isn't much more I can say. – forest Aug 6 '18 at 23:21

remote code execution depends on the service running on the open port

Not necessarily so.

Remote code execution is possible when the handling code of a vulnerable machine contains an error, and as a result of this error, the (probably binary) data sent by an attacker gets executed. The trick is, the erroneous code might theoretically be buried just anywhere, including the OS kernel itself, which will allow remote code execution with arbitrary packets, even the packets of port-less protocols like ICMP or GRE.

Or, the mistake in the packet handling code might lead to RCE with a packet to just whatever port is open on the target machine, here's one example.

I would now take a chance to switch into an "aggressive guess" mode and to assume that you're asking the question because you've just seen a few open ports in the output of your network scanner and now wonder whether those may impose a security risk. Sorry, but this piece of data is not enough to figure that out. You may take a vulnerability scanner (like Nessus) instead, it would play better because that's what it's designed for.

Not the answer you're looking for? Browse other questions tagged or ask your own question.