Services Exploitation
Identify the application before choosing the port's page. Start anonymously where supported; repeat useful checks with each newly recovered identity.
Windows scan: common services, AD clues and what to inspect next
Ports below are common defaults, not service identification. Confirm the responding application, including on unusual ports. An open port is a lead, not proof of access or a vulnerability.
| Service | Common ports | What it suggests | Inspect next |
|---|---|---|---|
| DNS | 53 TCP/UDP | DNS server; may support AD, but not proof of a DC. | Domain/host records and DC SRV records; zone-transfer permissions. DNS checks. |
| Kerberos | 88, 464 TCP/UDP | KDC / password-change service; a strong AD clue alongside LDAP/SMB. | Realm/domain, DC identity, DNS and time alignment; then account-specific ticket prerequisites. Kerberos. |
| LDAP / Global Catalog | 389, 636, 3268, 3269 TCP; 389 UDP for CLDAP | Directory service; GC and domain naming contexts support a DC hypothesis. LDAP alone can be another directory/AD LDS. | RootDSE naming contexts and hostname, anonymous versus authenticated reads, useful users/groups/SPNs. RootDSE access is not full directory access. LDAP. |
| AD Web Services | 9389 TCP | AD management endpoint, commonly on DCs; can also serve AD LDS. | Confirm the directory instance and domain context; authenticated AD queries still require the relevant access. Domain context. |
| SMB / NetBIOS session | 445 / 139 TCP | File sharing on standalone or domain hosts; SMB alone does not identify a DC. | Anonymous/guest versus known-account access; readable shares, configs and backups; SMB dialect/signing requirement. Share access is not remote-execution rights. SMB. |
| RPC endpoint mapper / dynamic RPC | 135 TCP; often 49152–65535 TCP | Windows RPC services, possibly WMI/DCOM, SAMR or printing. | Map registered interfaces, their endpoint and access requirements. High RPC ports are not automatically separate vulnerable applications. RPC enumeration. |
| RDP | 3389 TCP/UDP | Interactive desktop access on either host type. | Host/certificate identity, NLA and permitted remote-logon accounts. If access works, inspect available desktop apps and resources. A valid password alone is insufficient. RDP checks. |
| WinRM | 5985 / 5986 TCP | HTTP / HTTPS remote management on either host type. | Endpoint/authentication and local versus domain identity; verify remoting authorization. Successful SMB authentication does not establish WinRM rights. WinRM access. |
| HTTP / HTTPS | 80, 443, 8080, 8443 TCP; others possible | IIS or another application, API or management interface; not necessarily Windows or AD. | Use the app normally; inspect hostnames, roles, forms, uploads/downloads and actual product/version. If certificate enrollment is identified, follow its AD CS prerequisites. Web discovery. |
| Microsoft SQL Server | Usually 1433 TCP; Browser 1434 UDP; named instances may use other ports | Database/application role on a standalone or domain host. | Instance, SQL versus Windows login, effective database/server rights, impersonation and linked servers. A login is not automatically sysadmin. SQL Server. |
| FTP | 21 TCP; data ports vary | File-transfer service, sometimes tied to a web/application directory. | Anonymous/login access, readable files and upload permissions; establish who consumes an uploaded file. Upload alone is not code execution. FTP. |
| SSH | 22 TCP | OpenSSH or another SSH server can also run on Windows. | Authentication methods and account context; after access verify the actual OS, shell and identity. SSH access. |
| SNMP | 161 UDP | Optional management inventory, on either kind of host. | Available community/access context, system description, interfaces and exposed process/software information. UDP silence is inconclusive. SNMP. |
DC or member/standalone? A matching DNS + Kerberos + LDAP/GC + SMB cluster strongly suggests a DC; confirm with directory naming contexts and DC SRV records. SMB/RDP/WinRM by themselves do not distinguish a domain member from a standalone host. Missing/filtered DC ports do not prove the host is standalone.
After a foothold: correlate a listening port with its process, service account, executable/configuration and permissions before selecting a local escalation path. Windows host enumeration.
Microsoft Windows service/port reference · AD ports and roles.
SMB: list shares before selecting files
smbclient -N -L //TARGET
smbclient -L //TARGET -U 'DOMAIN/USER'
smbclient //TARGET/SHARE -U 'DOMAIN/USER'
The authenticated commands prompt for the password. A listed share may still deny entry. Inside an accessible share, use ls, cd DIRECTORY and get FILE; prioritize readable application configuration, scripts and backups. Share access is not permission to execute remotely.
SSH: verify the identity behind recovered access
ssh USER@TARGET
After login, run id and hostname, then continue with Linux or Windows host enumeration as appropriate. A rejected password can reflect the wrong account context or disabled password authentication. When authorized guessing is the specific next check, use SSH login guessing.
Review a public exploit candidate
When enumeration identifies an exact product/component and build, compare the exploit's affected versions, authentication/configuration, OS and architecture prerequisites before running it. A matching version string alone is not proof.
Use the Public exploit finder for search websites, host-specific suggesters and public exploit sources already linked in these notes.
Use the existing exploit selection and adaptation procedure for SearchSploit review, dependency repair, compilation/cross-compilation, endpoint and payload changes. Keep the original source and document changes. After execution, verify the landed shell and identity; if it fails, separate application evidence from execution-chain problems.