3

Fairly new to infosec and am going through a course on nmap. While scanning I found this and it looked interesting and was wondering if you all had any information on this?

This is the port,state and service in question.

464/udp   open|filtered kpasswd5 
2

1 Answer 1

3

The fact you're seeing this service and port suggests you may be scanning a Domain Controller, for which both UDP & TCP ports 464 are used by the Kerberos Password Change. This port in particular is used for changing/setting passwords against Active Directory.

Doing an nmap -A might help you identify which version is being run and could assist in helping you work out what type of attack it's vulnerable against.

On a side note, if you're like me and find it useful to know why that service exists, the one in question has a good read up here.

Not the answer you're looking for? Browse other questions tagged or ask your own question.