135

Port 135/tcp is registered with IANA as epmap with the description "DCE endpoint resolution," assignee Joe Pato, and a blank reference field (dual-registered on TCP and UDP); Microsoft and Nmap universally call it the RPC Endpoint Mapper, or MSRPC (msrpc). It is the Windows analog of the SunRPC portmapper: a client contacts port 135 to discover which dynamic port a given RPC interface — identified by a UUID — is currently using, then connects to that resolved endpoint. The mechanism is rooted in OSF DCE/RPC from the early 1990s, and on Windows the RPCSS service runs the endpoint mapper on the well-known port 135; it is foundational to DCOM, MSRPC, WMI, Exchange, the Service Control Manager, and the Task Scheduler. The IANA reference field is blank. Port 135 is one of the most consequential Windows attack surfaces in history. Microsoft Security Bulletin MS03-026 (July 2003) documented a critical buffer overrun in the DCOM RPC interface reachable on TCP 135 (among other ports), and the W32.Blaster / MSBlast / Lovsan worm exploited it beginning 11 August 2003: it scanned port 135, used the overflow to open a remote shell on port 4444, fetched its payload over TFTP (UDP 69), and spread aggressively — the SANS Internet Storm Center observed scanning hosts jump from around a thousand to over 58,000. The Nachi/Welchia worm followed, CERT advisory CA-2003-19 corresponds, and MSRPC has accrued many vulnerabilities since. As a result, port 135 should never be internet-exposed and is heavily firewalled at the perimeter, while APTs also use it for reconnaissance and lateral movement. For an analyst, an open 135 marks a Windows host exposing the RPC endpoint mapper; on the perimeter it is a red flag and a classic worm and lateral-movement surface that should be blocked externally.

IANA assignment

epmap — "DCE endpoint resolution"; reference (blank — no RFC cited in IANA registry); assignee Joe Pato; dual-registered 135/tcp + 135/udp; commonly called MSRPC / RPC Endpoint Mapper [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

among the most commonly open Windows ports; nmap labels it msrpc (de-facto) [Well-established] — nmap-services file

Related ports

137/138/139 (NetBIOS), 445 (SMB direct hosting), 593 (RPC over HTTP), dynamic RPC ports (49152+)

Primary use

RPC endpoint mapper — resolves RPC interface UUIDs to dynamic ports

Other/unofficial uses

foundation for DCOM, WMI, Exchange, SCM, Task Scheduler [Well-established]

Security implications

classic Windows attack surface — MS03-026 DCOM RPC overflow; Blaster/MSBlast (Aug 11 2003) → shell on 4444, TFTP payload (UDP 69); Nachi/Welchia; CA-2003-19; never internet-expose; APT recon/lateral movement

Typically seen on

Windows hosts — domain controllers, file servers, workstations

Analyst note

An open 135 = a Windows host exposing the RPC endpoint mapper; on the perimeter it is a red flag and a classic worm/lateral-movement surface. Block at the firewall externally.

Port 135/udp is registered with IANA as epmap with the description "DCE endpoint resolution," assignee Joe Pato, and a blank reference field — the registry cites no RFC for this entry, and it is dual-registered on both TCP and UDP. In practice the service is the Microsoft RPC (Remote Procedure Call) Endpoint Mapper, the directory component of the DCE/RPC architecture that Windows inherited. A client that wants to reach an RPC service (DCOM, WMI, NetLogon, Active Directory replication, the Service Control Manager) sends the service's interface UUID to port 135, and the Endpoint Mapper replies with the dynamic high port and binding where that service is actually listening; the client then connects directly to that port. The UDP binding corresponds to the datagram DCE/RPC transport ncadg_ip_udp, one of several transports the locator service supports, while the TCP binding ncacn_ip_tcp carries the large majority of modern Windows RPC traffic in practice. Either way port 135 is active on default Windows Server and Windows desktop installations. For an analyst the port matters as both a reconnaissance surface and a historical exploit vector. Querying the Endpoint Mapper with tools such as rpcdump (Impacket), rpcmap, or Metasploit MSRPC auxiliary modules enumerates the host's registered RPC interfaces and their dynamic bindings, exposing installed services and attack surface ahead of lateral movement. The most significant exploit tied to this port is the Blaster (MSBlast) worm of August 2003: a buffer overflow in the Windows DCOM RPC interface, fixed by Microsoft Security Bulletin MS03-026 (CVE-2003-0352), that spread by scanning port 135 and infected an estimated 423,000+ systems within the first week after its 2003-08-11 detection. Standard hardening guidance is to block inbound 135/udp (and 135/tcp) at perimeter firewalls except for explicitly required internal management.

IANA assignment

epmap — "DCE endpoint resolution"; reference (blank — no RFC cited in IANA registry); assignee Joe Pato; dual-registered 135/tcp + 135/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=135)

Range class

well-known (0–1023) [Confirmed]

Related ports

137–139 (NetBIOS), 445 (SMB), 593 (RPC over HTTP), and the dynamic RPC high-port range

Primary use

Microsoft RPC / DCE Endpoint Mapper — client submits a service UUID to port 135 and receives the dynamic port/binding for that RPC service; UDP binding is ncadg_ip_udp

Common software

Windows RPC service (rpcss), DCOM, WMI, NetLogon, Active Directory replication, Service Control Manager; default-on across modern Windows Server and desktop editions

Other access paths to RPC

SMB on 139/445 and HTTP on TCP 593 are alternative DCE/RPC transports

Security implications

prime reconnaissance target — Endpoint Mapper enumeration (rpcdump, rpcmap, Metasploit MSRPC modules) reveals registered RPC interfaces and dynamic bindings before lateral movement; standard guidance blocks inbound 135 at the perimeter [Confirmed] — https://www.verylazytech.com/network-pentesting/msrpc-port-135-539 , https://www.manageengine.com/vulnerability-management/misconfiguration/windows-firewall/how-to-close-port-135-udp-tcp-disabling-dcom-service-control-manager.html

Notable CVE / malware

CVE-2003-0352 — DCOM RPC buffer overflow exploited by the Blaster/MSBlast worm (first detected 2003-08-11, ~423,000+ systems in the first week), patched by MS03-026 (rated Critical, 2003-07-16); the related Sasser worm (2004) targeted a distinct LSASS RPC path. No post-2010 critical CVE specific to the UDP endpoint-mapper path was confirmed by this pass [Confirmed/Threat-reported] — https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-026 , https://learn.microsoft.com/en-us/troubleshoot/windows-server/security-and-malware/blaster-worm-virus-alert , https://isc.sans.edu/diary/RPC+DCOM+WORM+MSBLASTER/25

Typically seen on

Windows hosts (servers and desktops); an internet-exposed 135 is a recon/attack-surface concern

UDP vs TCP

both transports share the epmap registration; UDP/135 (ncadg_ip_udp) is active by default but TCP/135 carries most modern RPC endpoint-mapper traffic; hardening blocks both [Confirmed] — IANA registry; https://lisandre.com/cheat-sheets/msrpc

Analyst note

An exposed 135/udp on a Windows host is normal internally but should not face the internet; treat external exposure as an enumeration and exploitation risk and confirm it is firewalled.