Port 12345 – NetBus (NetBus RAT, OfficeScan Agent, Common Test Port)

Port 12345 is infamous as the default control port of NetBus, a late-1990s Windows remote-access trojan (RAT) that, alongside Back Orifice on port 31337, defined the first generation of point-and-click backdoors. An attacker running the NetBus client would connect to TCP 12345 on an infected machine and get full remote control of the desktop — keystroke logging, file upload/download, screen capture, running programs, moving the mouse, and party tricks like popping the CD tray open and closed. That reputation is why 12345 still lights up scanners as “suspicious.” The modern reality is more mundane: 12345 is a memorable, sequential number (1-2-3-4-5) that plenty of legitimate software also grabs — the Trend Micro OfficeScan management agent listened here for years, and countless dev servers, apps, and quick tests bind it because it’s easy to remember. So the real job on an open port 12345 isn’t to assume a trojan — it’s to identify exactly what is listening before you decide whether it’s a backdoor or a boring app.

Why It’s Open

There is no single official service on port 12345 — IANA does not register it to a major protocol — so an open 12345 is one of a few things, and the whole task is telling them apart:

• The NetBus trojan (the reason for the reputation). NetBus was written in 1998 by Swedish programmer Carl-Fredrik Neikter. Its server component runs as a faceless process listening on TCP 12345 (and 12346 for some functions); the NetBus 2.0 “Pro” rebrand later moved to port 20034. On connect, a NetBus 1.x server helpfully identifies itself with a plaintext banner, which is exactly how it gets caught. If 12345 is answering with a NetBus banner, you’re looking at a compromised host.
• Trend Micro OfficeScan agents. For years the OfficeScan client (tmlisten.exe) listened on TCP 12345 to receive engine/pattern updates and administrative commands from its management server. On a corporate Windows fleet, an open 12345 is far more likely to be an OfficeScan agent than a trojan — but see the CVE section, because that listener had its own bug.
• Custom apps, dev servers, and test listeners. 12345 is a “memorable port”: it’s the sort of number a developer types when spinning up a quick service, a message queue, a debug endpoint, or a one-off socket server. Games (Little Fighter 2, among others) and assorted utilities also default here. None of this is malicious — it’s just noise you have to identify and account for.
• Modern malware paying homage. As with 31337, some contemporary RATs and droppers still choose 12345 out of tradition or laziness, so an unexplained listener that isn’t NetBus, OfficeScan, or a known app still deserves a hard look.

Common Risks

• A live backdoor / full remote control. If the listener genuinely is NetBus (or a modern RAT parked on 12345), the attacker has interactive control of the host: keystroke capture, file transfer, screen and webcam grabs, process launch, and registry access. That is total compromise of that machine and a pivot into the rest of the network.
• Framing and evidence tampering. A RAT with file-transfer capability can plant material on a victim’s disk — the NetBus story below is the textbook case — so a compromise here is not just data theft but a chain-of-custody and reputational problem.
• Design-level exposure, not a patchable “port 12345 bug.” NetBus is malware, so there is no vendor patch and no “port 12345 CVE” to fix; the risk is the presence of the backdoor itself. The same design-level thinking applies to a custom app carelessly bound to 0.0.0.0:12345 with no authentication.
• Denial of service on legacy OfficeScan. Old OfficeScan clients could be knocked to 100% CPU by hammering port 12345 (see CVE below) — a real, if dated, availability risk on unpatched enterprise endpoints.
• Mistaken identity in both directions. Dismissing a NetBus banner as “just a dev server,” or nuking a production OfficeScan agent because “12345 means trojan,” are both failures. Fingerprinting first is the only safe move.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

The entire exercise on port 12345 is identification: is this a backdoor, an OfficeScan agent, a web/dev service, or something else? Start with version detection, then confirm with a raw banner.

Detect the service and version

nmap -sV -p 12345 <target>

Nmap’s version detection carries a native fingerprint for NetBus, so a -sV scan will often name it outright and flag OfficeScan or an HTTP service where relevant. This is the single most useful command here.

Grab the raw banner (NetBus announces itself)

nc -nv <target> 12345

A NetBus 1.x server replies to a bare TCP connection with a plaintext banner such as NetBus 1.70 — an unambiguous confirmation of the trojan and its version. Any other response (or a binary/HTTP reply) points you toward OfficeScan or a custom app instead.

Pull the banner with an NSE script

nmap -sV --script banner -p 12345 <target>

The stock banner script captures whatever the service prints on connect — handy for logging the exact NetBus version string or an app’s greeting alongside the scan.

Check whether it’s actually a web/dev service

curl -sI http://<target>:12345/

An HTTP response means a web or dev app, not a trojan — read the Server: / X-Powered-By headers and test it like any other web service.

Sweep the malware-category scripts (general, not NetBus-specific)

nmap -sV --script malware -p 12345 <target>

Nmap’s malware category runs its backdoor-detection scripts (vsftpd, UnrealIRCd, etc.). None specifically fingerprint NetBus, so treat this as a general safety net — the -sV banner is what actually confirms NetBus here.

Record every open port 12345, the service you positively identified, and the exact banner or version string, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

There is no “port 12345 CVE,” and NetBus itself has none. NetBus is malware, not a shipped product, so it has no vendor advisory and no patch — the risk is simply that the backdoor is present. The only real CVE that maps to this port belongs to a legitimate product that happened to listen here:

• CVE-2000-0204 — The Trend Micro OfficeScan client allows remote attackers to cause a denial of service by making 5 connections to port 12345, driving CPU utilisation to 100%. CVSS 5.0. Public PoC archived as Exploit-DB 19780, which notes OfficeScan clients “listen to port 12345 in order to receive periodical database engine updates and other administrative commands.” This is dated (OfficeScan Corporate Edition 3.x) but is the canonical example of a benign 12345 service with a real bug.

Beyond that, the exposure on port 12345 is design-level, not a CVE you can patch: either a backdoor/RAT is running (remove it, don’t patch it), or a custom app is exposed without authentication (put auth and a firewall in front of it). Identify the specific product and version behind the port and check its advisories — there is no shortcut keyed to the port number.

The previous version of this page cited CVE-1999-0660 as a “NetBus” vulnerability. That CVE candidate has been REJECTED by MITRE — it was never about a specific product, only a generic note that “a hacker utility, back door, or Trojan Horse is installed on a system, e.g. NetBus, Back Orifice.” It is not a real, scoped vulnerability and has been removed. Always verify a CVE against its NVD record before trusting it.

Mitigation

• Identify the listener before you act. Fingerprint it (nmap -sV, nc banner) so you know whether you’re removing a trojan, patching an agent, or securing an app — the response is completely different for each.
• If it’s NetBus or any RAT: treat the host as fully compromised. Isolate it from the network, capture forensic evidence first (memory, disk, the banner), remove the backdoor and its persistence, rotate every credential that touched the box, and reimage rather than “clean” anything business-critical.
• If it’s a Trend Micro OfficeScan agent: confirm it’s an expected, inventoried endpoint, patch it to a supported release, and restrict the management port to the OfficeScan server’s address range rather than leaving it open to the LAN or internet.
• If it’s a custom or dev app: bind it to localhost or an internal interface, put it behind authentication and a reverse proxy, and never publish 0.0.0.0:12345 to untrusted networks.
• Firewall TCP/12345 so only the hosts that legitimately need it can reach it, and audit cloud security groups and container port maps for an accidental exposure.
• Close it and rescan if nothing owns it. An unexplained open 12345 is exactly the kind of listener worth hunting to ground before you shrug it off.

Real-World Example

The definitive NetBus story is the case of Magnus Eriksson, a law scholar at Lund University in Sweden. In 1999, system administrators found roughly 3,500 child-pornography images on his work computer, and he was assumed to have downloaded them knowingly. He lost his research position, and after his name was published he fled the country and needed medical care to cope with the fallout. Years later, in late 2004, he was acquitted when the court accepted that NetBus had been used to remotely control his machine and plant the files — the images had been placed there by someone else through the trojan listening on port 12345. It remains the canonical example of how a remote-access trojan can be used not just to steal data but to frame an innocent person, and of why an open 12345 with a NetBus banner is a serious incident, not a curiosity. It’s also the port-12345 lesson in miniature: the port number itself is trivial and shared with harmless software, but what is listening on it — here, a backdoor with full file-write access — is the entire attack surface.

FAQ

What is port 12345 used for?

Port 12345 has no single official service. It is historically the default control port of the NetBus remote-access trojan, but it is also used by legitimate software — most notably the Trend Micro OfficeScan management agent — and it’s a common ad-hoc pick for custom apps, dev servers, and quick tests because it’s such a memorable number. On an open 12345, the first step is to identify which of these is actually running.

Is port 12345 always a trojan or a sign of infection?

No — not anymore. In the late 1990s an open 12345 strongly suggested NetBus, but today it’s far more often a benign app or an OfficeScan agent. It becomes a confirmed compromise only when the listener actually behaves like a backdoor — for example, replying with a plaintext NetBus <version> banner. Fingerprint it before assuming the worst.

How do I know if it’s NetBus specifically?

Connect and read the banner: nc -nv <host> 12345. A NetBus 1.x server announces itself with a plaintext string like NetBus 1.70, and nmap -sV -p 12345 <host> carries a native fingerprint that will name it. An HTTP response, an OfficeScan identification, or an unrecognised binary greeting means it is not classic NetBus — investigate that service on its own terms.

Does port 12345 have a CVE I need to patch?

Not for NetBus — NetBus is malware with no vendor and no patch, so there is no “port 12345 CVE” to apply; you remove the backdoor instead. The one real CVE tied to this port is CVE-2000-0204, an old denial-of-service bug in the Trend Micro OfficeScan client’s 12345 listener. Everything else here is design-level risk — a backdoor’s presence or an unauthenticated app — rather than a patchable flaw.

How does NetBus compare to Back Orifice?

They are siblings from the same era: NetBus (1998, port 12345) and Back Orifice (1998, port 31337) were the two headline Windows backdoors that popularised point-and-click remote control. Both give an attacker full control of an infected host; both left a legacy of “cursed” port numbers that scanners still flag. Modern offensive tooling has largely moved to frameworks whose listeners you’ll more often see on ports like 4444.

How do I secure or close port 12345?

Identify the service first. If it’s a RAT, isolate and reimage the host and rotate credentials. If it’s an OfficeScan agent, patch it and restrict the port to its management server. If it’s a custom app, bind it to localhost or put it behind authentication and a proxy. Then firewall TCP/12345 to only the hosts that need it, and rescan with nmap -p 12345 <host> to confirm anything you closed is actually closed.

TL;DR

• Service: no single standard — historically the NetBus RAT (default TCP 12345), today more often a Trend Micro OfficeScan agent, a custom app, or an ad-hoc test/dev listener
• Default port: 12345/TCP (NetBus also uses 12346; NetBus Pro 2.0 moved to 20034)
• Biggest risk: a live backdoor giving full remote control (keylogging, file transfer, screen capture, evidence planting) — but most open 12345s today are benign, so identify what’s answering before you react
• Mitigation: fingerprint the listener (nmap -sV, nc banner); reimage and rotate creds if it’s a RAT, patch and lock down OfficeScan, authenticate and proxy custom apps, and firewall TCP/12345 to only the hosts that need it