Port 7777 – Game Server and Custom App Port (Terraria, ARK, Unreal Engine)

Port 7777 has no single standard service — it is the default port for a long list of game servers and a grab-bag of custom applications. Terraria, ARK: Survival Evolved, the Unreal Engine / Unreal Tournament family, San Andreas Multiplayer (SA-MP), and Just Cause 2 Multiplayer all bind 7777 out of the box, and in the enterprise world Oracle HTTP Server serves its non-SSL web interface on 7777 by default. Custom and indie apps reach for it too, and — because it’s a memorable number that was never tied to a critical system service — it has a long history of being squatted by Windows backdoors. Because so many different things listen here, the first job on an open port 7777 isn’t to attack a known protocol — it’s to identify what is actually answering, and then assess that. Most often it’s a game server; sometimes it’s a custom app or an enterprise web tier; occasionally it’s a backdoor.

Why It’s Open

The dominant real-world use of port 7777 is game servers. It is the default listen port for so many titles that an open 7777 on a random host is, more often than not, someone running a dedicated game server:

• Terraria dedicated servers default to 7777.
• ARK: Survival Evolved uses 7777 as its game port (with a query port alongside).
• Unreal Engine / Unreal Tournament and the many games built on that engine default the game port to 7777 (with adjacent query/GameSpy ports at 7778 and 7787).
• San Andreas Multiplayer (SA-MP) and Just Cause 2 Multiplayer both listen on 7777.

Because these servers need real-time, low-latency traffic, many use both TCP and UDP around 7777, which is why a full check scans both. On a home connection an open 7777 usually means a game server someone deliberately port-forwarded; on a cloud VM it can be a community server, a custom app, or something less benign.

Port 7777 is also a custom-app and enterprise default. Oracle HTTP Server (Oracle Application Server / Fusion Middleware Web Tier) serves its non-SSL HTTP interface on 7777 unless reconfigured, so in enterprise environments an open 7777 can be a web tier rather than a game. Internally developed tools frequently pick 7777 when the usual ports are taken. And historically the port has been used by malware — the tiny Tini Windows backdoor (a ~3 KB assembler trojan) opens 7777 as an unauthenticated command shell — so an open 7777 that no one can account for deserves a closer look rather than a shrug.

Common Risks

• Exposed, unpatched game servers. Community-run dedicated servers are notoriously behind on patches, and the older engines that default to 7777 (Unreal in particular) carry real remote-code-execution and denial-of-service bugs (see CVEs below). A vulnerable dedicated-server binary reachable from the internet is a direct compromise or crash target.
• DDoS target. Game servers on 7777 are a favourite target for UDP floods and reflection/amplification attacks aimed at knocking players offline, and a poorly-configured UDP service can itself be abused as a reflector.
• Weak or absent admin/RCON auth. Many game servers expose an RCON or admin console with a weak, shared, or default password; take that over and you control the server and often the host.
• Information disclosure. Status and query endpoints happily return server version, map, mod list, and player names — handy fingerprinting for an attacker deciding which exploit to try.
• Exposed custom apps and web tiers. A custom app or an Oracle HTTP Server on 7777 carries its own vulnerabilities, and dev/internal tools bound here often lack authentication, input validation, or TLS.
• Backdoors hiding in plain sight. Because 7777 has a history of trojan use, an open 7777 dismissed as “probably a game” can be an unauthenticated remote shell.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

The whole game on port 7777 is identifying the service before you test it. Start with a version scan across both protocols, then branch on what answers.

Detect the service and version

nmap -sV -p 7777 <target>
nmap -sU -sV -p 7777 <target>

Grab the raw banner

nc -nv <target> 7777

Check whether it’s an HTTP service (Oracle HTTP Server, custom app)

curl -sI http://<target>:7777/

An HTTP response points to a web app — read the headers to fingerprint it. A Server: Oracle-HTTP-Server (or Oracle-Application-Server) banner identifies an Oracle web tier; any other Server:/X-Powered-By header names a custom stack you then test like any other web app.

Fingerprint a game server

If the banner is binary or the service replies to a game query, identify the title and version — this tells you which engine’s bugs apply:

# Nmap's game-server query scripts (e.g. Valve/Source-style query on the query port)
nmap -sU -sV --script "discovery and *query*" -p 7777,7778,27015 <target>

Community query tools (a Terraria/ARK/Unreal server browser, or a Source-query script) will return version, map, mods, and player count. Note the query port often sits next to 7777 (7778 for Unreal, 27015 for ARK/Source), so scan the neighbours too.

Run a scripted vulnerability check

nmap --script vuln -p 7777 <target>

Log every open port 7777, the service you positively identified, and any credential or query result you confirm, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

There is no generic “port 7777” CVE — the flaws that matter belong to whatever is listening. Modern occupants like Terraria, ARK, and SA-MP don’t have simple named network CVEs for their dedicated servers, so the honest first step there is to identify the exact server and version and check that product’s advisories. The most credible named CVEs on this port belong to the older Unreal-engine game-server family, whose game port defaults to 7777 and whose query/GameSpy listeners on the adjacent 777x/10777 ports had real, exploited bugs:

• CVE-2004-0608 — The Unreal Engine “secure” GameSpy query overflow. A single, spoofable UDP packet carrying a long “secure” query value overwrites memory and executes arbitrary code. CVSS 10.0. It affects a huge library of Unreal-engine games — Unreal Tournament, UT2003, UT2004 (before 3236), DeusEx, Postal 2, Rune, Tactical Ops and more — and is weaponised in Metasploit (exploit/linux/games/ut2004_secure, exploit/windows/games/ut2004_secure) and Exploit-DB 16693. The GameSpy query listens on 7787 by default, alongside the 7777 game port.
• CVE-2002-1507 — Unreal Tournament 2003 clients and servers crash (denial of service) on malformed messages sent to UDP 7778 or 10777 — the query ports adjacent to the 7777 game port. CVSS 5.0.
• CVE-2008-3396 — Unreal Tournament 2004 (3369 and earlier): a crafted sequence of malformed packets triggers a NULL-pointer dereference and crashes the server daemon. CVSS 5.0.
• CVE-2008-7011 — The Unreal engine (UT3 1.3, UT2003/2004, Postal 2, Pariah and others): an authenticated player forces a server exit through repeated file downloads that trip an assertion failure in UnChan.cpp. CVSS 4.0. Public PoC as Exploit-DB 32386.

For a custom app or an Oracle HTTP Server on 7777, the CVEs to check are those of that specific product and version — not of “port 7777.”

The previous version of this page cited CVE-2021-22986 as relevant here. That is an F5 BIG-IP iControl REST SSRF/RCE bug with nothing to do with port 7777 or any 7777 service, and it has been removed, along with vague, unverified “Unreal RCON” exploit links. Verify every CVE against its NVD record and scope it to the actual product before trusting it.

Mitigation

• Identify the real service first. You can’t secure port 7777 generically — it could be a game server, an Oracle web tier, a custom app, or a backdoor. Fingerprint it, then harden the specific thing behind it.
• If it’s a game server: patch the dedicated-server binary to the latest build (the old Unreal-engine titles especially), run it as an unprivileged user in a container or sandbox, put it behind DDoS protection, secure RCON/admin with a strong unique password and an IP allowlist, and don’t co-locate it with sensitive systems.
• If it’s a custom or dev app: don’t expose it to untrusted networks — bind it to localhost or put it behind a reverse proxy with authentication and TLS on 443, and disable debug/verbose errors on anything internet-facing.
• If it’s an Oracle HTTP Server or other web tier: patch it, front it with a proxy/WAF, and keep the admin surface off the public internet.
• Firewall port 7777 (TCP and UDP) to the players or clients that actually need it, and audit cloud security groups and container port mappings for an accidental 0.0.0.0:7777.
• Close it if nothing legitimately needs it, and rescan to confirm — an unexplained open 7777 is a red flag worth hunting for a backdoor before you dismiss it.

Real-World Example

The Unreal Engine “secure” query flaw (CVE-2004-0608) is the cleanest illustration of why an open 7777 has to be identified, not assumed. Because virtually every game built on that engine defaulted its listen ports to the 7777 family and answered GameSpy queries on 7787, a single, spoofable UDP packet — one that could even be aimed at a broadcast address — was enough to overwrite memory and run code on the server. Researcher Luigi Auriemma’s disclosure covered an entire library of titles at once, from Unreal Tournament to Postal 2, and the exploit was folded into Metasploit, so mass-scanning the 7777 range and firing one packet at whatever answered was trivial. It’s the port-7777 lesson in miniature: the port number is mundane and shared by dozens of unrelated programs, but whatever happens to be listening on it — here, an unpatched game engine — is the real attack surface, and identifying it is the whole job.

FAQ

What is port 7777 used for?

Port 7777 has no single standard service. It is the default port for many multiplayer game servers — Terraria, ARK: Survival Evolved, the Unreal Engine / Unreal Tournament family, San Andreas Multiplayer, and Just Cause 2 Multiplayer among them — and it is also Oracle HTTP Server’s default non-SSL web port, plus a common pick for custom and internal apps. On an open 7777, the first step is to identify which of these is actually running.

Why is port 7777 open on my computer or router?

Most often because a game server is running or has been port-forwarded to it — Terraria, ARK, and other titles use 7777 by default. It can also be a custom application, an Oracle web tier, or, less commonly, malware: the Tini backdoor opens 7777 as a remote shell. If you don’t recognise the service, fingerprint it before trusting it.

Is port 7777 safe to leave open?

The port itself is harmless; the risk depends on what’s behind it. A patched game server behind DDoS protection and a strong RCON password is generally fine to expose to players. An unpatched community server, a debug/dev app, an internet-facing Oracle HTTP Server, or an unexplained listener is worth locking down. Don’t publish 7777 to untrusted networks without knowing exactly what answers on it.

Is port 7777 TCP or UDP?

Both. Many game servers use TCP and UDP around 7777 for real-time traffic, and query/GameSpy functions often sit on adjacent UDP ports (7778, 7787, or 27015). Oracle HTTP Server and most custom web apps speak HTTP over TCP. Scan both protocols (nmap -sV -p 7777 and nmap -sU -sV -p 7777) to be sure.

How do I find out what’s running on my port 7777?

Fingerprint it: nmap -sV -p 7777 <host>, nc -nv <host> 7777 for a raw banner, and curl -sI http://<host>:7777/ to see whether it answers as HTTP. A game-server query reply identifies the title and version, a Server: Oracle-HTTP-Server header points to an Oracle web tier, another HTTP banner points to a custom app, and an unrecognised binary banner deserves a closer look before you assume it’s benign.

How do I secure or close port 7777?

Identify the service first, then harden it: patch and sandbox game servers behind DDoS protection with strong RCON auth, bind custom/dev apps to localhost or a reverse proxy with authentication and TLS, patch and proxy any Oracle web tier, and firewall 7777 (TCP and UDP) to the clients that need it. If nothing needs it, stop the service and confirm the port is closed with a rescan.

TL;DR

• Service: no single standard — most often a game server (Terraria, ARK, Unreal Engine, SA-MP, Just Cause 2 MP), also Oracle HTTP Server, custom apps, and historically the Tini backdoor
• Default port: 7777/TCP and 7777/UDP (game queries often on adjacent 7778/7787/27015)
• Biggest risk: an unpatched or misconfigured game server (RCE/DoS bugs in the older Unreal engine, DDoS target, weak RCON) or an unexpected listener that turns out to be a backdoor — identify what’s answering before you trust it
• Mitigation: fingerprint the real service, patch and sandbox game servers with strong RCON and DDoS protection, bind custom apps to localhost/reverse-proxy, patch Oracle/web tiers, and firewall port 7777 if nothing needs it