Common attacks and weaknesses
- A listener on 31337 on a production host is a red flag.
Port 31337: Back Orifice / elite
Registered to eldim at IANA, but known as the "elite" port, historically used by the Back Orifice backdoor and by many CTF and malware tools.
31337
How Back Orifice / elite works
Other servicesThe client sends a request to port 31337 and the Back Orifice / elite service answers. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 8/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- Other services
Is port 31337 dangerous?
How to secure it
- Investigate unexpected listeners.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 31337
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| eldim | 31337 | TCP, UDP | eldim is a secure file upload proxy | - | 2021-05-14 |
// source: IANA service name and port number registry
Which program uses port 31337, and is it reachable?
Linux
sudo ss -ltnup 'sport = :31337' # process listening on 31337
sudo lsof -nP -i :31337macOS
sudo lsof -nP -i :31337
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 31337 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 31337 netstat -ano | findstr :31337
From another machine
nmap -p 31337 -sV <host> sudo nmap -sU -p 31337 <host> nc -zv <host> 31337
Block it in the firewall
sudo ufw deny 31337/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 31337" -Direction Inbound -LocalPort 31337 -Protocol TCP -Action Block # Windows
What is port 31337 used for?
Registered to eldim at IANA, but known as the "elite" port, historically used by the Back Orifice backdoor and by many CTF and malware tools.
Is port 31337 TCP or UDP?
Port 31337 is registered for TCP and UDP.
Is it safe to open port 31337?
It is rated 8/10 (high) when exposed to the Internet. A listener on 31337 on a production host is a red flag. Investigate unexpected listeners.
How do I check if port 31337 is open?
On Linux run "ss -ltnup 'sport = :31337'", on macOS "lsof -nP -i :31337", and on Windows "netstat -ano | findstr :31337" to see the local process. From another machine, "nmap -p 31337 <host>" shows whether it is reachable.
Other other services ports
:4444 Metasploit default / krb524 tcp · udp · high risk :1 TCP Port Service Multiplexer tcp · udp :5 Remote Job Entry tcp · udp :9 Discard tcp · udp · sctp · dccp :11 Active Users tcp · udp :17 Quote of the Day tcp · udp :18 Message Send Protocol (historic) tcp · udp :27 NSW User System FE tcp · udp