{
  "port": 1524,
  "protocol": "tcp",
  "service": "ingreslock",
  "oneLiner": "Registered to the Ingres database lock daemon, but famous as the classic UNIX backdoor port.",
  "whatItIs": "IANA assigns 1524 to \"ingreslock\", the lock manager of the Ingres relational database (now Actian Ingres). Its lasting fame is different: for decades, UNIX rootkits, worms, and hand-placed backdoors have bound an unauthenticated root shell to 1524, because \"ingreslock\" in a netstat listing looks plausible enough to skim past. Rapid7's Metasploitable 2 ships exactly this as a teaching example — Rapid7's own guide calls it \"the old standby 'ingreslock' backdoor that is listening on port 1524\", and connecting with telnet drops you at a root prompt with no password. Finding 1524 open on a host that has no Ingres installation is a compromise indicator, not a service.",
  "exposure": {
    "verdict": "never",
    "note": "If you did not deliberately install Ingres, an open 1524 should be treated as a live backdoor and investigated as an incident — and even the genuine Ingres lock daemon is an internal database component with no reason to face a network you do not control."
  },
  "checkCommand": "nmap -Pn -sV -p 1524 TARGET",
  "links": [
    {
      "title": "Rapid7 — Metasploitable 2 Exploitability Guide (ingreslock backdoor on 1524)",
      "url": "https://docs.rapid7.com/metasploit/metasploitable-2-exploitability-guide/",
      "kind": "official-docs"
    },
    {
      "title": "Actian Ingres documentation",
      "url": "https://docs.actian.com/ingres/11.2/index.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 1524",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1524",
      "kind": "iana"
    }
  ]
}