Service:
msmq
Protocol:
TCPPort:
1801Used for:
Microsoft Message Queuing serviceWhy It’s Open
Port 1801 is used for Microsoft Message Queuing (MSMQ) service, which provides asynchronous message delivery between distributed applications in enterprise environments. It enables applications to communicate across heterogeneous networks and systems that may be temporarily offline, and integrates with Microsoft Windows Server, Active Directory, and various enterprise applications. Organizations use MSMQ for reliable message transfer in distributed business applications.
Common Risks
- Message injection
Attackers may insert malicious messages into the queue - Authentication bypass
Improper configurations may allow unauthorized queue access - Privilege escalation
MSMQ service accounts may have excessive permissions - Data leakage
Sensitive information in message queues may be exposed - Denial of Service
Queue flooding can exhaust system resources - Message interception
Unencrypted message traffic can be captured
Want to save time on reporting?
Let PentestPad generate, track, and export your reports - automatically.
Enumeration & Testing
Service Detection:
nmap -sV -p 1801MSMQ Queue Enumeration:
sc query msmqCheck MSMQ Configuration:
reg query "HKLM\SOFTWARE\Microsoft\MSMQ"PowerShell Queue Access:
Get-MSMQQueue -ComputerNameWhat to Look For
| Checkpoint | What it means |
|---|---|
| Queue permissions | Check which users/groups have read/send/receive access to queues |
| Message encryption | Verify if messages in transit or at rest are encrypted |
| Directory integration | Check if MSMQ is integrated with Active Directory |
| Service account | Identify which account runs the MSMQ service and its privileges |
| Network exposure | Verify if queues are accessible from outside the organization |
Mitigation
- Message encryption
Enable transport-level encryption for all queues - Least privilege
Run MSMQ service with minimal required permissions - Access controls
Implement strict ACLs on message queues - Network segmentation
Place MSMQ servers in protected network zones - Message validation
Validate message content before processing - Regular auditing
Monitor queue access and message activity - Patch management
Keep MSMQ components updated with security patches
TL;DR
- Port 1801 = Microsoft Message Queue service
- Protocol: TCP
- Used for: Microsoft Message Queuing service
- Security focus: Proper configuration and monitoring required
Known CVEs and Exploits
- CVE-2008-3479 – Microsoft Message Queuing Service buffer overflow vulnerability
- CVE-2020-0618 – Microsoft Message Queuing remote code execution vulnerability
- Message injection attacks – Malicious message insertion into queue systems