4

I've run metasploit against my web-server and it found several opened ports that I didn't know. Please note that I have a firewall and IPSec configured but they were disabled just for testing purposes (servers should be secure even if firewalls are bypassed).

Here's the list of open ports:

enter image description here

It's a Windows 2008 R2 with IIS 7.5, SQL Server 2008 R2, MSMQ and Memcached installed (among other things). Do you know how to secure those ports (eg, MSMQ should open ports to the public I think)?. Thanks!

Additional info:

  • Ports 135 used by svchost.exe, running "RPC Endpoint manager", RpcSs and MSMQ
  • Ports 445 used by "System" (?)
  • Ports 2103,2105,2107 being used by MSMQ
  • Port 49152 used by "wininit.exe - Windows Start-Up application"
  • Port 49153 used by svchost.exe, running "TCP/IP NetBIOS Helper", "DHCP Client" and "Windows Event Log"
  • Port 49170 used by services.exe
Improve this question
2
  • 2
    Running SMB server (port 445) on a web server is probably not a good idea since SMB is a primary target for hackers and in the past had been source of a lot of worms as well. Also, SMB fingerprinting is a reliable way of remotely fingerprinting the OS upto the build number details that is why you should disable it on a dedicated web server machine.
    – void_in
    Commented Nov 29, 2013 at 17:38
  • Thanks. I've disabled those services based on this guide: msdn.microsoft.com/en-us/library/ms143455%28v=sql.105%29.aspx
    – Diego Jancic
    Commented Nov 29, 2013 at 19:01

1 Answer 1

Reset to default
2

Your question should not be "How do I secure these ports" your but rather "How do I secure the services listening on these ports".

There is a wealth of knowledge on well known ports available on the internet and the services that run behind them. I would recommend researching hardening of IIS / Windows server and go from there.

It's good that you've taken a proactive approach to assess your web server, and understanding how it functions. It's not uncommon for known good services to initiate communications and open ports dynamically, so even if your research to a high number port comes empty handed it's not necessarily something to worry about. For the most part Windows IIS is pretty secure out of the box and doesn't require too much tweaking, but just ensure that you're updating your server with patches regularly. These days most attackers will focus on the web application running on your server, rather than attacking the server itself.

Using TCP View will also provide you with a look into what services are utilizing the ports.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .