Port 2222 – DirectAdmin/SSH (Secure Shell)

Port 2222 has no single standard service — it is most often an alternate SSH port or the DirectAdmin hosting control panel, and occasionally something else entirely. Unlike port 22, which is tied to SSH, or 443 to HTTPS, nothing is guaranteed to be on 2222, so the first job on any host answering here is to identify what is actually listening. In practice it’s one of three things: an SSH daemon an administrator moved off port 22, a DirectAdmin web panel (its default port), or — much less often — an industrial EtherNet/IP endpoint, a management appliance such as ESET Remote Administrator, or malware using 2222 for command-and-control. Fingerprint it before you assume.

Why It’s Open

Alternate SSH. The single most common reason 2222 is open is that someone moved sshd off port 22. It’s a memorable choice — 22 with a stutter — and the goal is to duck the constant automated password-guessing that hammers port 22. The service behind it is the same OpenSSH daemon with the same configuration and the same attack surface; only the port number changed. This is security by obscurity: it cuts log noise from dumb bots, but it is not a security control, because internet scanners (and modern botnets) enumerate 2222 just as readily as 22. All the real SSH content — auth, keys, crypto, CVEs — lives on the port 22 (SSH) page.

DirectAdmin. Port 2222 is the default listening port for DirectAdmin, a commercial web-hosting control panel that lets administrators and resellers manage domains, accounts, databases, DNS, and mail through a web UI (HTTP or HTTPS). If you see 2222 open on a shared-hosting or VPS box, DirectAdmin is the likely answer, sitting alongside the services it manages — FTP on 21, mail, and databases.

Other uses. IANA registers 2222 as EtherNet/IP: UDP 2222 carries CIP implicit (cyclic I/O) messaging on industrial networks, paired with TCP 44818 for explicit messaging. You’ll also see 2222 used by appliances like ESET Remote Administrator, by some IoT/DVR and Android-debug setups, and by malware for C2 — which is exactly why 2222 should never be assumed to be “just SSH.”

Common Risks

• The port change is not protection. When 2222 is alt-SSH, every SSH risk still applies — password brute-forcing, weak or default credentials, exposed root login, and unpatched OpenSSH. Moving off 22 only filters the laziest bots; a real attacker finds the new port in one scan. Treat it exactly like port 22.
• An exposed hosting panel is a high-value target. An internet-facing DirectAdmin login on 2222 is a management surface for an entire server. Privileged access to the panel can lead to remote code execution through its upload/file utilities and to disclosure of sensitive data such as database backups.
• Panel brute-force and weak credentials. DirectAdmin has no rate limiting by default beyond its optional Brute Force Monitor, and default or reused admin/reseller passwords fall to automated login attacks (Metasploit ships a dedicated DirectAdmin login scanner that targets 2222).
• DirectAdmin application bugs. The panel has had real XSS and CSRF flaws that let a malicious link — clicked by a logged-in admin — create rogue admin accounts, schedule cron jobs, or upload a webshell. See the CVEs below.
• Service misidentification. Assuming 2222 is SSH when it’s actually DirectAdmin (or the reverse) means you test the wrong thing and miss the finding. Always fingerprint.
• Banner and version disclosure. Both sshd and the DirectAdmin panel leak version information that maps straight to known CVEs.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

The whole game on 2222 is identifying what answers, then testing it as that service.

Fingerprint the service

nmap -sV -p 2222 <target>

ssh in the output means it’s alt-SSH; an http/ssl/http service (often with a DirectAdmin title) means the panel; EtherNet/IP points at industrial gear.

Grab the raw banner

nc -nv <target> 2222

An SSH-2.0-OpenSSH_... line confirms SSH and its version; an HTTP response header points at DirectAdmin or another web service.

If it’s SSH — test it as SSH

ssh -p 2222 user@<target>
ssh-audit -p 2222 <target>

ssh-audit flags weak ciphers, MACs, key exchanges, and known issues in one pass. Everything on the port 22 page applies unchanged.

If it’s DirectAdmin — probe the panel

curl -k -i https://<target>:2222

A DirectAdmin login page (or a Server/title referencing DirectAdmin) confirms the panel. Brute-force testing of the login with Metasploit:

msfconsole -q
use auxiliary/scanner/http/directadmin_login
set RHOSTS <target>
set RPORT 2222
set USER_FILE users.txt
set PASS_FILE passwords.txt
run

If it’s industrial — treat it as OT

EtherNet/IP explicit messaging lives on TCP 44818; fingerprint that with nmap’s enip-info script and handle the host as OT, not a server.

Log every open instance, the confirmed service, and any successful login so it lands in the final pentest report instead of a scratch file.

What to Look For

Known CVEs and Exploits

When 2222 is alt-SSH, the vulnerabilities are SSH’s, not the port’s — regreSSHion (CVE-2024-6387) and Terrapin (CVE-2023-48795) among them. They’re covered on the port 22 (SSH) page and aren’t repeated here. The CVEs below are the ones specific to DirectAdmin, the service 2222 most often exposes as its own default:

• CVE-2019-9625 — CSRF in DirectAdmin 1.55 via the /CMD_ACCOUNT_ADMIN URI. A forged request lets an attacker create a new administrator account when a logged-in admin is tricked into triggering it. CVSS 8.8. Exploit-DB 46520.
• CVE-2019-11193 — Cross-site scripting in the DirectAdmin File Manager (through v1.561) via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER. The XSS is used to bypass CSRF protection and take over the admin panel; the published chain goes on to add admin accounts, schedule cron jobs for command execution, and upload a webshell. CVSS 6.1. Exploit-DB 46694.
• CVE-2024-10385 — Stored XSS in the ticket-management system of the DirectAdmin Evolution skin (fixed in 1.668). A low-privileged user stores JavaScript that executes with administrator privileges when an admin views the ticket, potentially enabling command execution. CVSS 8.6.

These need a logged-in admin (CSRF/stored-XSS delivery), not blind unauthenticated RCE — but on a busy hosting panel that condition is easy to meet, which is why patching DirectAdmin and restricting who can reach 2222 both matter.

Mitigation

• Don’t treat the port move as security. If 2222 is SSH, harden the daemon regardless of port: key-only auth (PasswordAuthentication no), PermitRootLogin no, a patched OpenSSH, and fail2ban or MaxAuthTries limits. Follow the full port 22 hardening guidance.
• Restrict the DirectAdmin panel. Firewall 2222 to trusted admin IPs or a VPN rather than the whole internet; DirectAdmin is a management interface, not a public service.
• Strong auth and 2FA. Enforce strong, unique admin/reseller passwords, enable DirectAdmin’s two-factor authentication, and turn on the built-in Brute Force Monitor.
• Patch the panel. Keep DirectAdmin current so the XSS/CSRF chains above are closed; run it behind HTTPS so panel credentials aren’t sniffable.
• Identify before you defend. Confirm what actually listens on 2222 — SSH, DirectAdmin, EtherNet/IP, or something unexpected like malware C2 — and lock down that specific service. An unknown listener on 2222 warrants investigation, not assumption.

Real-World Example

In 2019, researchers published a full attack chain against DirectAdmin up to version 1.561 (CVE-2019-11193). A reflected XSS in the panel’s File Manager, combined with the panel’s weak CSRF handling, meant a single malicious link was enough: when a logged-in DirectAdmin administrator opened it, the payload could silently create a new admin account, add a cron job to run arbitrary commands, and upload a webshell — turning one hosting-panel session into full control of the server and every site on it. It’s a clean illustration of why an exposed 2222 matters even when it “only” hosts a control panel: the risk isn’t the port number, it’s the privileged management application sitting behind it, and the humans who log into it.

FAQ

What is port 2222 used for?

There is no single standard service on port 2222. Most often it’s an alternate SSH port (an admin moved sshd off 22) or the DirectAdmin hosting control panel, which uses 2222 by default. It’s also the IANA-registered EtherNet/IP port (UDP 2222 for industrial I/O) and is sometimes used by appliances or malware. Fingerprint the host with nmap -sV -p 2222 to find out which.

Is running SSH on port 2222 more secure than port 22?

Only marginally, and not in a way you should rely on. Moving SSH to 2222 reduces noise from automated bots that only target port 22, but it’s the same sshd with the same vulnerabilities, and any real attacker scans for it. It’s security by obscurity, not a security control — keep key-based auth, disabled root login, patching, and rate limiting as your actual defenses.

What is DirectAdmin on port 2222?

DirectAdmin is a commercial web-hosting control panel, and 2222 is its default port. It exposes a web UI for managing domains, accounts, databases, DNS, and mail. Because it’s a privileged management interface, an internet-facing DirectAdmin login is a high-value target — restrict it to trusted IPs, enable 2FA, and keep it patched.

How do I tell if port 2222 is SSH or DirectAdmin?

Run nmap -sV -p 2222 <target> or grab the banner with nc -nv <target> 2222. An SSH-2.0-OpenSSH... banner means alt-SSH; an HTTP/HTTPS response with a DirectAdmin login page means the panel. curl -k -i https://<target>:2222 will show a DirectAdmin title if it’s the panel.

How do I secure or close port 2222?

Identify the service first. If it’s SSH, apply full SSH hardening regardless of the port. If it’s DirectAdmin, firewall 2222 to trusted admin IPs or a VPN, enable 2FA and the Brute Force Monitor, and patch the panel. If nothing needs 2222, stop the service and confirm the port is closed with a rescan.

TL;DR

• Service: no single standard — usually alternate SSH or the DirectAdmin control panel (2222 is DirectAdmin’s default); also EtherNet/IP and other uses
• Default port: 2222/TCP (identify the actual listener before testing)
• Biggest risk: SSH’s own risks unchanged by the port move, plus an exposed hosting panel (brute-force, weak creds, DirectAdmin XSS/CSRF → admin takeover → RCE)
• Mitigation: harden SSH regardless of port; restrict DirectAdmin to trusted IPs/VPN, enable 2FA, patch — and always confirm what’s really on 2222