Port 31337 – ELITE (Back Orifice and the "eleet" Hacker Port)

Port 31337 is famous less for a protocol than for a pun: written in leetspeak, 31337 reads as “eleet” (elite), and that single in-joke defines the port. Its serious claim to fame is Back Orifice, the Windows remote-access trojan released by the hacker collective Cult of the Dead Cow (cDc) at DEF CON in 1998, which used UDP 31337 as its default listener and gave an attacker complete, hidden remote control of a victim’s machine. But precisely because the number is a hacker in-joke, all kinds of things now bind to it on purpose: honeypots and canaries sit on 31337 as deliberate bait, CTF challenges and security tools use it as a wink, and plenty of legitimate apps and dev servers pick it as a joke when a “real” port would do. So an open port 31337 today is usually not Back Orifice — it’s more often a honeypot or a joke service. The job on this port is the same as the history is colourful: understand where it came from, then identify what is actually listening before you decide it’s a compromise.

Why It’s Open

The reason anything binds to 31337 at all is cultural. In leetspeak the digits spell “eleet,” so the port became shorthand for “a hacker was here,” and different kinds of software adopted it for different reasons:

• Back Orifice (the origin story). cDc’s 1998 backdoor shipped with UDP 31337 as its default port, cementing the association. Its 1999 successor, Back Orifice 2000 (BO2K), made the port fully configurable — so BO2K rarely sits on 31337, and a modern RAT that is on 31337 is often something imitating the legend rather than the original.
• Honeypots and canaries. Blue teams and researchers deliberately open 31337 as bait: because scanners and unsophisticated attackers gravitate to the “elite” port, a listener there is a cheap tripwire that logs whoever pokes it.
• CTF and security tooling. Capture-the-flag services, exploit-dev handlers, and hacking tools use 31337 as an in-group signal. It’s memorable, unreserved, and on-theme.
• Joke and dev services. Developers who know the reference bind test servers, debug endpoints, and hobby apps to 31337 for fun. On a laptop or a lab box, that’s the most likely explanation of all.

Because Back Orifice was a UDP service and modern occupants are frequently TCP (a web/dev server, a CTF socket), a thorough check has to look at both protocols — which is exactly what the original stub of this page got wrong by scanning only one.

Common Risks

• A live backdoor / RAT. If 31337 really is answering as Back Orifice — or any RAT that adopted the port — the host is fully compromised: an attacker has file access, keystroke logging, process and registry control, and screen capture. This is the worst case and the one the port’s reputation is built on.
• An exposed “joke” service with no security. A dev or hobby server bound to 31337 for laughs was almost never hardened. If it’s reachable from an untrusted network it likely has no authentication, no TLS, and verbose debug output — a soft target regardless of what it does.
• Walking into a honeypot. The flip side: connecting to a 31337 listener may mean you’ve tripped a canary. Your source IP, tools, and payloads are being recorded, and on an engagement that can burn your position.
• Assumption error in both directions. Treating every open 31337 as “just a game/joke” can miss a real backdoor; treating every open 31337 as “definitely Back Orifice” produces false-positive incident reports. The risk here is as much about misidentification as about any single service.
• Information disclosure. Whatever answers — a CTF banner, an HTTP Server: header, a BO info reply — tends to volunteer version and host details that make the next step easy for an attacker.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

There is no single “port 31337 exploit” to run — the entire task is figuring out what is listening, and only then testing it. Scan both protocols, because Back Orifice is UDP and most modern occupants are TCP.

Version-scan both protocols

# TCP: catches honeypots, CTF sockets, and joke web/dev servers
nmap -sV -p 31337 <target>

# UDP: Back Orifice is a UDP service, so this is the scan that finds the real thing
nmap -sU -sV -p 31337 <target>

Interrogate a suspected Back Orifice server

Nmap ships real NSE scripts for exactly this port. backorifice-info connects to a Back Orifice service and dumps host info (system setup, processes, shares, port redirections, plugins); backorifice-brute password-audits it (its ports argument is mandatory):

nmap -sU -p 31337 --script backorifice-info <target>
nmap -sU --script backorifice-brute --script-args backorifice-brute.ports=31337 <target>

Grab a raw banner (TCP services)

nc -nv <target> 31337

Check whether it’s just a web/dev server on a leet port

curl -sI http://<target>:31337/

An HTTP response means it’s a web app that picked 31337 as a joke or a honeypot — read the Server: / X-Powered-By headers and test it like any other web service. A CTF-style prompt or custom binary protocol points to a challenge or bespoke app. A backorifice-info reply that actually returns host data is the one result that means “treat this box as compromised.” (Note: raw nc -u UDP probing of Back Orifice is unreliable because the service is encrypted and won’t answer an arbitrary packet — let nmap’s version probe and the backorifice-* scripts do the talking.)

Record every open port 31337, the protocol it answered on, and the exact service you positively identified, so the finding lands in the pentest report with evidence attached rather than a guess about the port number.

What to Look For

Known CVEs and Exploits

There is no CVE for “port 31337,” and there is no CVE for Back Orifice — because Back Orifice is malware, not a catalogued vendor product with patchable flaws. A RAT isn’t a vulnerability in something; it’s the thing an attacker installs after exploiting a vulnerability elsewhere. So the honest answer here is that the risk on this port is a backdoor/RAT or an exposed joke/honeypot service, not a numbered network CVE. The CVEs that ever matter on 31337 belong to whatever software is actually listening — the web framework behind a dev server, the honeypot application, a CTF service — and you find those by fingerprinting the service and checking that specific product’s advisories.

Removed from the previous version of this page (both were wrong and have been deleted):

• CVE-1999-0660 was cited as “Back Orifice allows remote access.” It is a REJECTED CVE — a catch-all note meaning “a hacker utility, back door, or Trojan Horse is installed on a system,” explicitly ruled out of scope by MITRE because it describes a configuration state, not a software flaw. It is not a real vulnerability and should never be reported as one. (The sibling NetBus page for port 12345 carried the same bogus reference.)
• CVE-1999-0158 was cited as “Back Orifice allows unauthorized access.” It is actually a Cisco PIX Firewall Manager file-retrieval bug on port 8080 on Windows NT — a completely different product and port, mislabeled here.

Always verify a CVE against its NVD record and confirm the product and port match before trusting or reporting it.

Mitigation

• Identify before you act. You cannot secure “port 31337” generically — first determine whether it’s a backdoor, a honeypot, a CTF/tool socket, or a joke dev server, then respond to that.
• If it’s a real Back Orifice / RAT server: treat the host as fully compromised. Isolate it from the network, preserve volatile evidence, run multi-engine malware and rootkit scans, hunt for the persistence mechanism, and rebuild from known-good media rather than trying to “clean” a system that had a remote operator.
• If it’s a joke or dev service you own: don’t expose it to untrusted networks. Bind it to localhost or put it behind an authenticated reverse proxy with TLS, disable debug output, and — honestly — move it off the “elite” port so it stops attracting opportunistic scanners.
• If it’s a honeypot: that’s working as intended; just make sure it’s isolated from production and that its logs are going somewhere useful.
• Firewall 31337 (TCP and UDP) to nothing on the public internet, and audit cloud security groups and container port maps for an accidental 0.0.0.0:31337.
• Don’t administer real systems over legacy backdoored channels — if you’re still reaching hosts over cleartext Telnet on port 23 or exposed RAT-style handlers, fix that first; use authenticated, encrypted management instead.
• Close it and rescan if nothing legitimately needs it, and document the before/after in the pentest report.

Real-World Example

The canonical port-31337 event is the birth of Back Orifice itself. On August 1, 1998, at DEF CON 6, Cult of the Dead Cow released Back Orifice — written by the member known as Sir Dystic — as a deliberately provocative demonstration that Windows 95/98 had no meaningful defense against remote takeover. The tool was a client–server backdoor: drop the tiny server on a victim’s machine and it would hide itself, survive reboots, and let a remote operator log keystrokes, browse and move files, edit the registry, capture the screen, and run commands — all by default over UDP 31337. It spread widely, antivirus vendors scrambled to detect it, and Microsoft downplayed it, which only amplified the story. A year later, at DEF CON 7 (July 10, 1999), cDc’s Dildog shipped Back Orifice 2000 (BO2K) — this time open-source under the GPL, with Windows NT support, a plugin architecture, XOR/DES (and plugin-based strong) encryption, and, crucially, a configurable port. That last change is why “an open 31337” and “Back Orifice” drifted apart: the original made 31337 legendary, but its successor no longer needed it, and the number lived on as a cultural marker adopted by honeypots, CTFs, tools, and jokers far more than by the trojan that made it famous. The lesson is the same one every good enumerator applies: the port number is a story, but the service is the fact — identify what’s really answering before you write the finding.

FAQ

What is port 31337 used for?

Port 31337 has no single standard service. Historically it was the default UDP port for the Back Orifice Windows remote-access trojan (cDc, 1998). Today, because 31337 reads as “eleet” (elite) in leetspeak, it’s used just as often by honeypots, CTF challenges and security tools, and joke or dev servers that pick it as a wink. On an open 31337 the first task is to identify which of those is actually running.

Does an open port 31337 mean I’m infected with Back Orifice?

Not necessarily — and today, usually not. Back Orifice’s successor (BO2K) uses configurable ports, so real RATs often aren’t on 31337 at all, while honeypots and joke services deliberately are. An open 31337 is a reason to investigate, not an automatic infection verdict. Confirm it with nmap -sU -p 31337 --script backorifice-info <host>; if that returns live host data, then treat the machine as compromised.

Is port 31337 TCP or UDP?

Both, depending on what’s listening. Back Orifice itself defaulted to UDP 31337, so the UDP scan is the one that finds the real trojan. Most modern occupants — honeypots, CTF sockets, web/dev servers — use TCP. Scan both (nmap -sV -p 31337 and nmap -sU -sV -p 31337) so you don’t miss either case.

Is there a CVE for port 31337 or Back Orifice?

No. Back Orifice is malware, not a vendor product, so it has no CVE — a trojan is what an attacker installs, not a flaw to patch. Two CVEs (CVE-1999-0660 and CVE-1999-0158) were previously and wrongly attached to this port; one is a rejected catch-all and the other is a Cisco PIX Firewall Manager bug on port 8080. The real risk on 31337 is a backdoor or an exposed service, and any CVEs that apply belong to whatever software is actually listening.

How do I find out what’s really running on my port 31337?

Fingerprint it on both protocols: nmap -sV -p 31337 <host> and nmap -sU -sV -p 31337 <host>, nc -nv <host> 31337 for a raw TCP banner, and curl -sI http://<host>:31337/ to see if it’s HTTP. Use --script backorifice-info to test specifically for Back Orifice. A web banner means a joke/dev/honeypot service; a backorifice-info reply with host data means a real backdoor.

How is port 31337 related to NetBus and other backdoor ports?

31337 (Back Orifice) and 12345 (NetBus) are the two iconic late-1990s Windows RAT ports, and both stubs historically over-claimed the same fake CVE. Modern exploit-dev and RAT traffic more commonly rides handler ports like 4444 (the Metasploit default handler), and unexplained listeners on grab-bag/“joke” ports like 9999 deserve the same “identify before you trust it” treatment.

TL;DR

• Service: no single standard — historically the Back Orifice trojan (default UDP 31337), now just as often a honeypot, CTF/security tool, or joke dev server, thanks to 31337 reading as “eleet”
• Default port: 31337/UDP (Back Orifice) and 31337/TCP (most modern occupants) — scan both
• Biggest risk: a live backdoor/RAT means a fully compromised host; otherwise an unhardened joke/dev service, or tripping a honeypot. There is no CVE for port 31337 or Back Orifice — the risk is the service, not a numbered bug
• Mitigation: identify what’s actually listening (nmap -sU -sV -p 31337, backorifice-info), rebuild the host if it’s a real RAT, bind/authenticate/move joke services off the port, and firewall 31337 to nothing on the public internet