{
  "port": 6129,
  "protocol": "tcp",
  "service": "DameWare Mini Remote Control",
  "oneLiner": "DameWare Mini Remote Control's default port — famously scanned after its pre-auth overflows.",
  "whatItIs": "IANA leaves 6125-6129 unassigned; 6129 is claimed in practice by DameWare Mini Remote Control, a Windows remote-administration tool whose client service listens here by default. A pre-authentication buffer overflow made it a mass-scan target: CERT VU#909678, where a crafted packet mimicking a client compromises the server. Moving the service off the default port is common advice precisely because the number is so well known. A listener here means a managed Windows fleet, and a lot of internet background noise still probes it.",
  "exposure": {
    "verdict": "never",
    "note": "A remote-control agent with a history of pre-auth remote code execution has no business on a public IP; reach it over a VPN and keep the version current."
  },
  "checkCommand": "sudo lsof -nP -iTCP:6129 -sTCP:LISTEN",
  "links": [
    {
      "title": "CERT VU#909678 — DameWare Mini Remote Control buffer overflow (port 6129/TCP)",
      "url": "https://www.kb.cert.org/vuls/id/909678",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6125-6129 unassigned",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6129",
      "kind": "iana"
    }
  ]
}