{
  "port": 135,
  "protocol": "both",
  "service": "MSRPC endpoint mapper (epmap)",
  "oneLiner": "Windows RPC endpoint mapper — ask it where a service lives and it hands back a dynamic port.",
  "whatItIs": "Registered as `epmap`, DCE endpoint resolution, this is in practice the Microsoft RPC endpoint mapper. A client that wants an RPC interface asks 135 for its binding and is sent on to a dynamically assigned high port, which is why 135 is inseparable from the 49152–65535 range on Windows. WMI, DCOM, Exchange, the print spooler and countless management tools depend on it. It is open on essentially every Windows host, and it was the port the Blaster worm entered through in 2003.",
  "exposure": {
    "verdict": "never",
    "note": "An internet-facing endpoint mapper enumerates RPC interfaces and is a decades-long source of remote code execution bugs. ISPs commonly block 135 outright."
  },
  "checkCommand": "nc -vz TARGET 135",
  "links": [
    {
      "title": "MS-RPCE — Remote Procedure Call Protocol Extensions",
      "url": "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15",
      "kind": "official-docs"
    },
    {
      "title": "Service overview and network port requirements for Windows",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}