Port 4444 Details

known port assignments and vulnerabilities

threat/application/port search:

Port(s)	Protocol	Service	Details	Source
4444	tcp	trojans	Sophos Admin console default HTTPS port Metasploit listener port is 4444 (TCP/UDP) by default. I2P HTTP/S proxy uses this port. W32.Blaster.Worm [Symantec-2003-081113-0229-99] is a widely spread worm that exploits the DCOM RPC vulnerability described in MS Security Bulletin [MS03-026]. The worm allows remote access to an infected computer via ports 4444/tcp and 69/UDP, and spreads through port 135/tcp. To avoid being infected consider closing those ports. W32.Reidana.A [Symantec-2005-032515-4042-99] (2005.03.24) - worm that spreads using the MS DCOM RPC vulnerability (MS Security Bulletin [MS03-026]) on port 139. The worm attempts to download and execute a remote file via FTP. Opens TCP port 4444. Some other trojans using this port: AlexTrojan, CrackDown, Oracle, Prosiak, SwiftRemote, W32.Hllw.Donk.M, W32.mockbot.a.worm [Symantec-2004-022608-5242-99] HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444. References: [CVE-2012-2561] MinaliC Webserver is vulnerable to a stack-based buffer overflow, caused by improper bounds checking when processing HTTP Post method. By sending a specially-crafted request containing an overly long string to TCP port 4444, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. References: [XFDB-83714] KNet Web Server is vulnerable to a buffer overflow. By sending a specially-crafted request to TCP port 4444, containing an overly long string argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash. References: [XFDB-83114], [BID-58781], [EDB-24897] Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444, which allows remote attackers to conduct cross-protocol scripting attacks, and consequently execute arbitrary commands, via a crafted web site. References: [CVE-2018-5704] KRB524 (IANA official)	SG
4444	udp	applications	Rockwell Automation RSLinx is vulnerable to a denial of service, caused by improper validation of input by LogReceiver.exe and Logger.dll. By sending a specially-crafted request to UDP port 4444, a remote attacker could exploit this vulnerability to cause the service to stop handling incoming requests. References: [CVE-2012-4695] [XFDB-83275] [BID-58917] Backdoor.Win32.Mnets / Remote Stack Buffer Overflow - the backdoor listens for commands on UDP ports 2222 and 4444. Sending a mere 323 bytes we can overwrite the instruction pointer (EIP), potentially giving us program execution flow over the remote Malware. References: [MVID-2021-0031]	SG
4444	tcp	trojan	CrackDown, Oracle, Prosiak, Swift Remote	Trojans
4444	tcp	CrackDown	[trojan] CrackDown	SANS
4444	tcp	krb524	KRB524	SANS
4444	tcp,udp	nv-video	NV Video default	SANS
4444	tcp	Prosiak	[trojan] Prosiak	SANS
4444	tcp	SwiftRemote	[trojan] Swift Remote	SANS
4444	udp	krb524		SANS
4444	tcp	krb524	Kerberos 5 to 4 ticket xlator	Nmap
4444	udp	krb524	krb524	Nmap
4444	tcp,udp	threat	Napster	Bekkoame
4444	tcp,udp	threat	Prosiak	Bekkoame
4444	tcp,udp	threat	Swift Remote	Bekkoame
4444	tcp,udp	threat	W32.Blaster.Worm	Bekkoame
4444	tcp,udp	threat	W32.HLLW.Donk	Bekkoame
4444	tcp,udp	threat	W32.Mockbot	Bekkoame
4444	tcp,udp	threat	W32.Reidana	Bekkoame
4444	tcp	krb524	KRB524. "krb524 assigned the port	IANA
4444	udp	krb524	KRB524. "krb524 assigned the port	IANA
4444	tcp	nv-video	NV Video default. "krb524 assigned the port	IANA
4444	udp	nv-video	NV Video default. "krb524 assigned the port	IANA

22 records found

Related ports: 69 135 139 1098 1099 2222