I've run metasploit against my web-server and it found several opened ports that I didn't know. Please note that I have a firewall and IPSec configured but they were disabled just for testing purposes (servers should be secure even if firewalls are bypassed).
Here's the list of open ports:
It's a Windows 2008 R2 with IIS 7.5, SQL Server 2008 R2, MSMQ and Memcached installed (among other things). Do you know how to secure those ports (eg, MSMQ should open ports to the public I think)?. Thanks!
- Ports 135 used by svchost.exe, running "RPC Endpoint manager", RpcSs and MSMQ
- Ports 445 used by "System" (?)
- Ports 2103,2105,2107 being used by MSMQ
- Port 49152 used by "wininit.exe - Windows Start-Up application"
- Port 49153 used by svchost.exe, running "TCP/IP NetBIOS Helper", "DHCP Client" and "Windows Event Log"
- Port 49170 used by services.exe