Ctrlk
📜 Medium🛒 My Shop👾 Github📩 Telegram 📺 YouTube✖ Twitter
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Erlang Port Mapper Daemon - PORT 4369

Basic info

  • epmd is a service used by Erlang nodes to find each other in a cluster.

  • It listens by default on TCP/4369 and keeps track of running nodes + their associated ports.

  • When an Erlang node starts, it registers with epmd. Other nodes can then query epmd to discover connection details.

The issue? If epmd is exposed to the internet without access controls, an attacker can enumerate running nodes and sometimes connect directly to the Erlang shell, leading to RCE.

Enumeration

When you see port 4369 open, the first step is enumeration.

Nmap Service Detection

Output:

Connect to epmd

You can query epmd directly using ncat or Erlang tools.

If you send:

(epmd n command), it responds with a list of nodes.

Output:

Or use built-in tools:

output:

Here, rabbit is a registered Erlang node (often RabbitMQ or CouchDB).

Exploitation Scenarios

Once we know there’s an Erlang node, exploitation depends on the application running and security settings.

Scenario A – Connecting to Erlang Shell

If the Erlang node is configured with no cookie authentication or uses a default cookie, you can connect directly:

Then connect to target node:

If successful:

You now have a shell inside the Erlang node, where you can execute code.

Scenario B – Exploiting RabbitMQ / CouchDB

Applications like RabbitMQ (default uses rabbit node) rely on epmd. If the cookie is compromised, you can fully control the broker.

PoC to execute OS commands:

If successful, you get:

Erlang Cookie RCE

Remote Connection

If you can leak the Authentication cookie you will be able to execute code on the host. Usually, this cookie is located in ~/.erlang.cookie and is generated by erlang at the first start. If not modified or set manually it is a random string [A:Z] with a length of 20 characters.

More information in https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/ The author also share a program to brutforce the cookie:

7KB
epmd_bf-0.1.tar.bz2
Open

Local Connection

In this case we are going to abuse CouchDB to escalate privileges locally:

Example taken from https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution You can use Canape HTB machine to practice how to exploit this vuln.

Exploitation Workflow

Here’s a step-by-step attack chain:

  1. Scan target

  2. Enumerate nodes

  3. Extract Erlang cookie

    • Sometimes it’s in config files (/var/lib/rabbitmq/.erlang.cookie)

    • Weak/default cookie values (cookie, rabbit) are common in old setups.

  4. Connect using erl

  5. Ping the node

  6. Execute OS commands

    Result:

Tools for Exploiting epmd

  • Metasploit Module: auxiliary/scanner/erlang/epmd_enum

  • Nmap enumeration

Learn & practice For the Bug Bounty

Support VeryLazyTech 🎉
PreviousWS-Discovery - Port 3702/UDPNextCisco Smart Install - PORT 4786

Last updated