1

During a review of our IT infrastructure, we noticed that the majority of our Windows workstations had port 135 enabled.

A DCERPC services enumerator have been performed on theses workstations. Following this enumeration, we have some questions about how DCERPC really works:

1) Some DCERPC services were only available “locally” (word mentioned by the scanner) on port 135 e.g “WindowsShutdown” Named Pipe related ones. Does it means that a domain administrator will be able to call this service remotely to shutdown the operating system, or the term “locally” will prevent remote actions?

2) Some DCERPC were available on some TCP ports that did not appear on the full TCP port scan we made just before DCERPC services enumerator (e.g port 49665). Considering that the local Windows firewall was enabled, is it possible that theses ports were filtered during the TCP port scan, but appeared during the DCERPC enumeration on port 135? Or maybe theses ports are opened after communicating with the port 135?

3) What is the default permission to use the DCERPC services? Could we change theses permissions?

4) Does closing the port 135 will prevent the use of any DCERPC services?

Thanks.

0

You must log in to answer this question.

Browse other questions tagged .