Port 1000 – CADLOCK (Cadlock License Manager)

Port 1000 is the registered port for cadlock, listed by IANA as the service name cadlock2 on both TCP and UDP, and still labelled cadlock in nmap’s service database and older /etc/services files. It sits right at the top of the well-known system-port range (0–1023), and the “Cadlock License Manager” name attached to it points to an obscure, effectively undocumented software-locking service that has left almost no public footprint. In practice port 1000 is a round-number system port with no meaningful modern service behind it — which is exactly why an open 1000 is far more likely to be a custom application, an admin or proxy service parked on a tidy number, or a historic backdoor than anything actually called cadlock. As with port 666, the real job when you find 1000 open is to identify what is actually listening.

Why It’s Open

• Legacy IANA assignment. The cadlock/cadlock2 label lingers in port databases and scanner output, so tools still recognise 1000 by name even though the service behind it is vestigial.
• Round-number convenience. 1000 is a tidy, memorable number just inside the privileged range, so custom apps, internal admin panels, and proxies get parked on it — the same instinct that lands services on 4444.
• Backdoor/trojan squatting. Historic Windows-era trojans defaulted to 1000, so a leftover or copy-pasted backdoor can still bind there.
• Not a mainstream service. No widely deployed daemon genuinely claims 1000, so real “cadlock” traffic is almost never what you are looking at.

Common Risks

• Unknown, unauthenticated service. The biggest risk on 1000 is simply not knowing what it is. An open, unidentified listener on a round-number port deserves immediate fingerprinting rather than a shrug.
• Backdoor / C2 default. Port 1000 appears on classic trojan-port references — Der Spaeher (Der Späher), Direct Connection, and GOTHIC Intruder — the same “memorable number” pattern as NetBus on 12345 and Back Orifice on 31337. These are legacy, but the default occasionally resurfaces.
• Hand-rolled custom apps. A round number invites undocumented services, some benign and some genuinely malicious — the same reason 4444, the Metasploit handler default, is always worth a second look.
• No transport security. Whatever is bound to 1000 — an admin service, a proxy, or a backdoor — expect no encryption or authentication by default.
• False attribution. A stray cadlock label in scan output can lull you into ignoring a real backdoor. Never trust the label — verify the service.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect and fingerprint the service

nmap -sV -p 1000 <target>

Nmap may print cadlock or cadlock2 from its service database — treat that as a guess from the port number, not a verified protocol. There is no dedicated cadlock NSE script or Metasploit module; the entire task is identifying whatever actually answers.

Probe UDP as well

nmap -sU -sV -p 1000 <target>

The assignment covers both transports, so check UDP too — a listener may answer on only one.

Raw banner grab

nc -nv <target> 1000

A raw connect proves the port is open and often reveals a banner, prompt, or shell-like response that gives away a backdoor or custom app.

Wider context

nmap -A -p 1000 <target>

Pull OS, script, and traceroute context so you can correlate 1000 with everything else the host exposes — a trojan default rarely sits alone.

Log every open instance and whatever you fingerprint so it lands in the final pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

• No protocol-specific CVEs. There are essentially no CVEs for cadlock/cadlock2 or for “port 1000” as a network service — it was never a widely deployed listening daemon, and NVD has no Cadlock license-manager entry.
• Old page claims removed. A previous version of this page cited a “DarkComet RAT abuse – commonly using port 1000 for C&C” and “buffer overflow and authentication bypass in Cadlock license managers.” Both were removed: DarkComet’s default port is 1604, not 1000, and there is no public, verifiable Cadlock CVE — that claim traces to circular content-farm copy rather than NVD.
• The real exposure is the unknown service. Treat an open 1000 as “identify this listener,” then apply whatever CVE and exploit research matches the software you actually find — a backdoor, a web app, an admin panel — rather than a cadlock-specific bug.

Mitigation

• Identify what’s really on 1000 first. Fingerprint the service before anything else. If it isn’t something you deliberately configured, treat it as suspicious.
• Close it if it isn’t sanctioned. There’s no reason to expose a vestigial port like 1000 on a modern host — block it at the firewall and stop the listener.
• Don’t run unknown services on round-number ports. If you must host something real, put it on its documented port and record it, so a round number like 1000 never becomes an unexplained open listener.
• Hunt for backdoors. An unexplained 1000 listener is an incident-response trigger: check the process and its parent, autostart entries, and outbound connections. A host with a trojan default port open may already be compromised.
• Monitor and alert. Add 1000 to IDS and egress rules so any new listener or C2-style traffic is flagged early.

Real-World Example

Port 1000’s story is the gap between the label and reality. A scan turns up 1000 open, the operator sees cadlock next to it, thinks “some old licensing thing,” and moves on — when the listener is actually a leftover backdoor or an undocumented custom service. That folklore is the vulnerability. Since the late 1990s the port has been squatted by trojans such as Der Spaeher, Direct Connection, and GOTHIC Intruder, and because 1000 is a tidy round number just inside the privileged range, it is a natural home for hand-rolled admin services and proxies. The cadlock name is a distraction in every case — the fix is to fingerprint the service rather than trust the port label.

FAQ

What is port 1000 used for?

Port 1000 is the IANA-registered port for the cadlock service (registered as cadlock2 on both TCP and UDP). The “Cadlock License Manager” name refers to an obscure, effectively undocumented software-locking service, and the port sees almost no legitimate use today — so an open 1000 is far more likely to be a custom application, an admin service on a round number, or a historic backdoor than genuine cadlock traffic.

What is cadlock (or cadlock2)?

It’s the service name IANA assigns to port 1000. Nmap and older /etc/services files call it cadlock; the current IANA registry lists cadlock2. Both are essentially just a label — there is no widely deployed, documented cadlock daemon, which is why the assignment is best treated as vestigial.

What service runs on port 1000?

Officially cadlock/cadlock2. Realistically, anything: because 1000 is a memorable round number just inside the privileged range, it has been the default of legacy trojans (Der Spaeher, Direct Connection, GOTHIC Intruder) and is a common pick for hand-rolled or admin services. Always fingerprint the listener instead of trusting the port label.

Is port 1000 dangerous?

The port isn’t dangerous by itself — what’s dangerous is an unidentified service on it. An open 1000 that you didn’t deliberately configure should be treated as a potential backdoor or unauthorised app until you’ve confirmed exactly what’s listening.

How do I secure or close port 1000?

Identify the service first, then shut it down if it isn’t sanctioned: stop the process, block 1000 at the firewall, and investigate the host for compromise if the listener is unexplained. If you legitimately run something on 1000, move it to a documented port and record it. Rescan to confirm 1000 no longer answers.

TL;DR

• Service: cadlock (IANA cadlock2) — an obscure, effectively undocumented licensing/locking service; the assignment is largely vestigial
• Default port: 1000/TCP and 1000/UDP
• Biggest risk: an open 1000 is rarely a real cadlock service — it’s more likely a legacy trojan default (Der Spaeher, Direct Connection, GOTHIC Intruder), a custom service, or an admin listener on a round number, so the finding is “identify the unknown service”
• Mitigation: fingerprint what’s actually on 1000, close it if it isn’t sanctioned, avoid parking services on round-number ports, and treat an unexplained listener as an IR trigger