Active Directory - Common Open Ports

🔑 Authentication & Directory Services#

• 53/tcp (DNS) → Domain Name System, required by AD for name resolution.
• 88/tcp (Kerberos) → Main authentication protocol in AD.
• 389/tcp (LDAP) → Lightweight Directory Access Protocol, used to query users/groups.
• 636/tcp (LDAPS) → Secure LDAP over SSL.
• 3268/tcp (Global Catalog LDAP) → Forest-wide LDAP queries.
• 3269/tcp (Global Catalog LDAPS) → Encrypted Global Catalog LDAP.
• 464/tcp (kpasswd5) → Kerberos password change service.
• 9389/tcp (ADWS) → Active Directory Web Services (used with PowerShell/remote management).

📁 File & Share Services#

• 135/tcp (MSRPC) → Remote Procedure Calls, service communication.
• 139/tcp (NetBIOS-SSN) → File sharing (legacy, used with SMB).
• 445/tcp (Microsoft-DS/SMB) → Server Message Block, file sharing, SYSVOL, Netlogon.

🌐 Remote Management#

• 593/tcp (HTTP RPC EpMap) → RPC over HTTP.
• 5985/tcp (WinRM/WSMan) → Windows Remote Management (PowerShell Remoting).

💾 Storage & NFS#

• 111/tcp (RPCBind) → Used with NFS services.
• 2049/tcp (NFS) → Network File System (often a misconfiguration).
• 3260/tcp (iSCSI) → Storage service (rare in AD CTFs).

🔄 Dynamic RPC High Ports (Ephemeral Ports)#

• 49664, 49667, 49669, 49674, 49689, 57557, 57587/tcp → Dynamic RPC ports automatically opened by Windows Server.

🏆 Top Ports to Target in AD Enumeration#

• 53 (DNS) → Zone transfers, subdomain enumeration.
• 88 (Kerberos) → AS-REP roasting, Kerberoasting attacks.
• 389 / 636 (LDAP/LDAPS) → Dump users/groups, AD objects.
• 445 (SMB) → Shares, credentials, Group Policy Preferences.
• 135 (MSRPC) → User enumeration, service discovery.
• 5985 (WinRM) → Remote code execution after obtaining valid credentials.
• 9389 (ADWS) → Manage AD via PowerShell Web Services.