Posts on: Services

---

MySQL is an open-source SQL relational database management system. It runs on TCP port 3306 by default, and databases are frequently stored in a single .sql file — which makes a MySQL compromise both a data-disclosure event and, through file write and UDF, a direct path to OS-level code execution. 2025–2026 context: MySQL remains a high-value lateral target because it frequently runs as root or SYSTEM, holds FILE privilege on legacy installations, and exposes the plugin_dir write primitive that UDF exploitation depends on. The current CVE feed is dominated by Group Replication unauthenticated privilege escalation (CVE-2026-101781, CVSS 8.8), UDF privilege escalation (CVE-2025-30721), and application-layer “read-only” bypasses that turn a reporting tool into a file-write primitive (CVE-2025-67509).

Network File System (NFS) is a distributed file system protocol developed by Sun Microsystems in 1984. It lets clients mount remote directories as if they were local. NFS runs on 2049 TCP/UDP; the RPC portmapper (rpcbind) runs on 111 TCP/UDP and is how clients discover NFS and mountd (which is usually on a dynamic port in NFSv3). 2025–2026 context: NFS remains a high-value target because its defaults assume a trusted LAN — AUTH_SYS trusts whatever UID the client sends, NFSv3 sprays RPC services across dynamic ports, and a single careless export option (no_root_squash, or a stray space before (rw)) hands an attacker root on the server. The 2025–2026 CVE feed adds three new layers: rpc.mountd privilege escalation (CVE-2025-12801), NFS-over-TLS client-side flaws (CVE-2025-38571, CVE-2025-68243), and Windows Client for NFS and Portmapper heap overflows (CVE-2026-69949, CVE-2026-71334).

Introduction Communication protocol that facilitates communication between Oracle databases and applications over networks Solution for managing large, complex databases, typically in the healthcare, finance, and retail industries. It has a built-in encryption mechanism that ensures the security of data transmitted. Runs on TCP Port 1521 by default Oracle TNS - Basic Commands Command Description ./odat.py all -s <FQDN/IP> Perform a variety of scans to gather information about the Oracle database services and its components. sqlplus /@<FQDN/IP>/ Log in to the Oracle database. sqlplus username/password@10.129.204.235/XE as sysdba Log in to the Oracle database with sysdba privileges ./odat.py utlfile -s <FQDN/IP> -d -U -P –sysdba –putFile C:\insert\path file.txt ./file.txt Upload a file with Oracle RDBMS. sudo nmap -p1521 -sV 10.129.204.235 –open –script oracle-sid-brute Nmap SID Bruteforcing Oracle RDBMS Interaction Commands Command Description select table_name from all_tables; List all available tables in current database select name, password from sys.user$; Extract password hashes

Post Office Protocol version 3 (POP3) is a mail retrieval protocol: a client connects to the mail server, authenticates, and downloads messages to the local machine. Unlike IMAP, POP3 is a single-mailbox, download-and-store protocol — it does not synchronise folders, flags, or server-side state. Default ports: Port Service Encryption 110 POP3 Plaintext — STARTTLS optional 995 POP3S Implicit TLS 110 POP3 + STLS STARTTLS upgrade 2025–2026 context: POP3 is legacy, and that is the entire security story. It is still deployed on mail appliances, cPanel/Plesk hosting, and industrial equipment because it is simple — and it is frequently exposed to the internet without rate limiting, with plaintext credentials on port 110, and with no MFA. The current attack surface is not the protocol itself but the mail server implementation (Dovecot, Courier, Cyrus, Exim, Postfix), where 2025–2026 produced a steady stream of CVEs in mail parsers, TLS handling, and authentication.

Remote Desktop Protocol (RDP) provides a graphical interface to connect to another computer over a network connection. It is one of the most popular administration tools — and one of the most consistently exploited gateways, because it is enabled by default, frequently exposed, and under-monitored. Default port: TCP/3389. 2025–2026 context: RDP is not a legacy target. Microsoft shipped multiple critical RDP Server and Client CVEs across 2026 — authenticated and unauthenticated use-after-free flaws (CVE-2026-58626, CVE-2026-69525), an actively exploited privilege escalation (CVE-2026-21533), a CVSS 9.8 client-side RCE (CVE-2026-54990), and two xrdp vulnerabilities (CVE-2026-32105, CVE-2026-32107). At the same time, BlueKeep (CVE-2019-0708) was revived by the North Korean Kimsuky APT in a 2025 campaign against South Korea and Japan, proving that a 2019 pre-auth RCE remains a live initial-access vector on unpatched systems.

Server Message Block (SMB) is a client-server protocol that regulates access to files, directories, and other network resources. An SMB server exposes arbitrary parts of its local filesystem as shares, with access governed by ACLs. SMB runs on TCP port 445 by default (NetBIOS over TCP/139 is legacy). 2025–2026 context: SMB remains the single most valuable protocol in an AD environment — it is the file-access layer, the relay target, and the coercion transport. Three developments define the current landscape. CVE-2025-33073 resurrected NTLM reflection and removed the admin prerequisite for relay-based SYSTEM access. SMBGhost (CVE-2020-0796) is still in CISA’s KEV catalog, with estates still negotiating SMB 3.1.1 compression — one crafted packet away from Ring 0. And 2026 produced a cluster of SMB Server privilege-escalation CVEs (race conditions, auth-algorithm flaws, unbounded resource allocation) that are network-reachable with any authenticated account.

The Simple Mail Transfer Protocol (SMTP) sends email; IMAP or POP3 retrieve it. SMTP is the front door for phishing, spoofing, and BEC — and it is the protocol most often left at defaults on appliances, printers, and legacy applications. Default ports: Port Service Encryption 25 SMTP (MTA-to-MTA) Opportunistic STARTTLS 587 Submission (client-to-MTA) STARTTLS required 465 SMTPS Implicit TLS 2525 Alternate submission Varies UDP/25 is not a usable mail transport. Do not scan SMTP over UDP.

Simple Network Management Protocol (SNMP) is used to monitor and manage devices on a network — routers, switches, firewalls, printers, UPSes, and NAS appliances. It exposes device information through Object Identifiers (OIDs) organised in a Management Information Base (MIB) tree, and it frequently contains logs, configuration, and credentials. Ports: UDP/161 for agent queries, UDP/162 for traps. The most common reconnaissance failure is scanning only TCP. SNMP is UDP-only. A TCP-only scan reports the host as having no SNMP service, and the entire attack surface is missed.