4369 - Pentesting Erlang Port Mapper Daemon (epmd)
Basic Info
The erlang port mapper daemon is used to coordinate distributed erlang instances. His job is to keep track of which node name listens on which address. Hence, epmd map symbolic node names to machine addresses.
Default port: 4369
This is used by default on RabbitMQ and CouchDB installations.
Enumeration
Manual
Automatic
Erlang Cookie RCE
Remote Connection
If you can leak the Authentication cookie you will be able to execute code on the host. Usually, this cookie is located in ~/.erlang.cookie
and is generated by erlang at the first start. If not modified or set manually it is a random string [A:Z] with a length of 20 characters.
Local Connection
In this case we are going to abuse CouchDB to escalate privileges locally:
Metasploit
Shodan
port:4369 "at port"
Last updated
Was this helpful?