Port reference
Port 135 (TCP) – MSRPC Endpoint Mapper
Microsoft RPC endpoint mapper — directs clients to dynamic RPC service ports on Windows.
Default state
Open on virtually all Windows hosts and domain controllers. Should be firewalled from untrusted networks.
Common attacks
- Endpoint mapper enumeration of RPC services
- PetitPotam / authentication coercion via MS-EFSRPC
- DCOM-based NTLM relay vectors
- Remote service and task enumeration
Hardening
- Block 135 and the dynamic RPC range from untrusted networks
- Patch coercion vulnerabilities (PetitPotam, PrinterBug)
- Enforce SMB signing and LDAP channel binding to break relays
- Disable unneeded RPC services (Spooler on DCs)
- Restrict the dynamic RPC port range and firewall it
nmap snippet
nmap -p135 --script msrpc-enum <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 135?
Port 135 is the Microsoft RPC (MSRPC) endpoint mapper, also called the DCE/RPC locator. When a client wants to talk to a Windows RPC service — DCOM, WMI, the task scheduler, the print spooler, or directory replication — it first asks the endpoint mapper on 135 which dynamic high port that service is currently using, then connects there. It is a foundational piece of Windows networking and is present on essentially every domain-joined host.
Why it matters for security
Because the endpoint mapper advertises the RPC services a host exposes, port 135 is a rich enumeration target that reveals attack surface. More importantly, several RPC interfaces can be abused to coerce authentication: an attacker triggers the victim into making an authenticated connection back to an attacker host, where the credentials are relayed to LDAP or AD CS to escalate privileges — the basis of PetitPotam-style attacks.
How it's attacked
Tools enumerate the endpoint mapper to map RPC services and locate vulnerable interfaces. PetitPotam abuses MS-EFSRPC and the PrinterBug abuses the print spooler to force a domain controller to authenticate to an attacker, who relays that NTLM authentication to a privileged service. DCOM interfaces provide additional coercion and lateral-movement vectors.
Hardening checklist
Firewall port 135 and the dynamic RPC range from untrusted and client networks. Patch coercion bugs (PetitPotam, PrinterBug) and disable the print spooler on domain controllers. Break relay chains by enforcing SMB signing, LDAP channel binding, and Extended Protection for Authentication. Constrain the dynamic RPC port range so it can be tightly firewalled. Use the nmap script above to enumerate RPC services on hosts you are authorized to test.
Related ports
Frequently asked questions
- What is port 135 used for?
- Port 135 is the Microsoft RPC endpoint mapper. Clients query it to discover which dynamic port a given RPC service (DCOM, WMI, scheduled tasks, etc.) is listening on.
- Why is port 135 a security risk?
- It exposes the RPC service landscape for enumeration and is the entry point for authentication-coercion attacks like PetitPotam that force a host to relay its credentials.