Port reference
Port 1524 (TCP) – ingreslock
Nominally an Ingres database lock service, but infamous as a bind-shell backdoor port that often yields instant root.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Rarely a real service. A listening 1524 is usually a backdoor bind shell left by an attacker, as on Metasploitable.
What is port 1524 used for?
Port 1524 is officially registered for ingreslock, a lock service of the old Ingres database — software you are very unlikely to encounter today. In practice the port is far better known for something else: it is a classic location for a bind-shell backdoor. On the deliberately vulnerable Metasploitable lab image and on compromised hosts, a root shell is left listening here.
When would you open it?
Realistically, you wouldn't. Almost nothing legitimate uses 1524 anymore, so there is no normal reason to open or forward it. If you find it listening on one of your machines, treat it as a finding to investigate rather than a service to enable.
Is it safe to open?
No — a service on 1524 is most often a leftover backdoor that hands out a shell with no authentication, so block it and inspect the host. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1524
nmap -p 1524 <target>netstat -ano | findstr :1524
Test-NetConnection <host> -Port 1524lsof -i :1524
nmap -p 1524 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1524 to your device's local IP, internal port 1524, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1524/tcpsudo firewall-cmd --permanent --add-port=1524/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1524 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1524" -Direction Inbound -Protocol TCP -LocalPort 1524 -Action AllowSecurity & risks
Common attacks
- Bind-shell backdoor listening on 1524 for direct attacker access
- Instant root shell on misconfigured or compromised hosts
- Mass scanning for the classic ingreslock backdoor
- Use as a persistence channel after initial exploitation
Hardening
- Treat a listening 1524 as a likely backdoor and investigate the host
- Inspect inetd/xinetd and startup scripts for a shell bound to 1524
- Block inbound 1524 at the perimeter firewall
- Rebuild the host if a backdoor is confirmed and rotate credentials
How to block this port
sudo ufw deny 1524/tcpsudo firewall-cmd --permanent --remove-port=1524/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1524 -j DROPNew-NetFirewallRule -DisplayName "Block 1524" -Direction Inbound -Protocol TCP -LocalPort 1524 -Action Blocknmap snippet
nmap -p1524 -sV --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is port 1524 considered a backdoor?
- Although 1524 is registered for the Ingres database lock service, it is far better known as a bind-shell backdoor. Attackers and lab targets like Metasploitable leave a root shell listening on it for instant access.
- What happens if I connect to an open port 1524?
- On a backdoored host you often land directly in a root shell with no authentication. That is why a listening 1524 should be treated as a compromise and investigated immediately.