Microsoft Windows provides multiple built-in services and protocols that allow systems to communicate, share files, host websites, and enable remote administration. These services are essential in enterprise environments, but they are also common targets for attackers because misconfigurations, weak credentials, and unpatched vulnerabilities can provide unauthorized access to a system.

Understanding how these services work, their default ports, and their common weaknesses is important for penetration testers, system administrators, and SOC analysts.

Service	Default Port	Purpose
IIS (Internet Information Services)	TCP 80/443	Microsoft web server for hosting websites and applications
WebDAV	TCP 80/443	HTTP extension for remote file management
SMB/CIFS	TCP 445	File and printer sharing service
RDP	TCP 3389	Remote desktop access to Windows systems
WinRM	TCP 5985/5986	Remote management protocol for Windows

IIS (Internet Information Services)¶

IIS is Microsoft’s web server software used to host websites, web applications, and APIs on Windows servers. It supports technologies like ASP.NET, PHP, and static web hosting.

Attackers commonly target IIS servers because vulnerable web applications or outdated IIS versions can lead to remote code execution or data leakage.

Common Risks¶

Directory traversal
File upload vulnerabilities
Misconfigured authentication
Default pages exposing server information
Outdated IIS modules

Example¶

An attacker scans a target server and discovers port 80 open.

nmap -sV 192.168.1.10

Output:

80/tcp open  http Microsoft IIS 10.0

The attacker may then enumerate directories using tools like Gobuster.

gobuster dir -u http://192.168.1.10 -w wordlist.txt

If a vulnerable upload feature exists, the attacker may upload a malicious ASPX shell.

WebDAV (Web Distributed Authoring and Versioning)¶

WebDAV is an extension of HTTP that allows users to upload, edit, move, and delete files on a remote web server. It is often enabled on IIS servers.

If authentication is weak or anonymous access is enabled, attackers may upload malicious files to gain remote access.

Common Risks¶

Anonymous file upload
Weak authentication
Arbitrary file execution
Misconfigured permissions

Example¶

An attacker checks whether WebDAV is enabled.

davtest -url http://192.168.1.10

If upload permissions are enabled:

cadaver http://192.168.1.10

The attacker uploads a malicious file:

put shell.aspx

The uploaded shell can then be executed through the browser.

SMB/CIFS (Server Message Block)¶

SMB is a Windows protocol used for sharing files, printers, and resources across a network. It is one of the most targeted Windows services because it is commonly exposed internally in enterprise environments.

SMB attacks often involve weak passwords, anonymous shares, relay attacks, or exploitation of known vulnerabilities such as EternalBlue.

Common Risks¶

SMB relay attacks
Null sessions
Weak credentials
EternalBlue vulnerability
Open file shares

Example¶

Enumerating SMB shares:

smbclient -L //192.168.1.20/ -N

Using Nmap SMB scripts:

nmap --script smb-enum-shares.nse -p445 192.168.1.20

If SMBv1 is enabled and vulnerable, attackers may attempt exploitation using Metasploit.

msfconsole

use exploit/windows/smb/ms17_010_eternalblue

RDP (Remote Desktop Protocol)¶

RDP allows administrators and users to remotely access Windows systems with a graphical interface. It is heavily targeted by attackers because it provides direct remote access.

Exposed RDP services on the internet are frequently attacked using brute force or credential stuffing.

Common Risks¶

Weak passwords
Brute force attacks
BlueKeep vulnerability
Credential theft
Exposed internet-facing RDP

Example¶

Scanning for RDP:

nmap -sV -p3389 192.168.1.30

Brute-force attempt using Hydra:

hydra -L users.txt -P passwords.txt rdp://192.168.1.30

If valid credentials are obtained:

xfreerdp /u:administrator /p:password123 /v:192.168.1.30

WinRM (Windows Remote Management)¶

WinRM is Microsoft’s remote management protocol used for automation and administrative tasks. It is commonly used in enterprise networks for PowerShell remoting.

Attackers abuse WinRM after obtaining credentials because it provides command execution on remote systems.

Common Risks¶

Credential reuse
Pass-the-hash attacks
PowerShell abuse
Weak administrator passwords

Example¶

Checking WinRM access:

crackmapexec winrm 192.168.1.40 -u admin -p password123

Connecting using Evil-WinRM:

evil-winrm -i 192.168.1.40 -u admin -p password123

Once connected, attackers can execute PowerShell commands remotely.

whoami
hostname
ipconfig

Why These Services Are Targeted¶

Windows services are frequently exploited because they:

Run by default in many environments
Often use weak or reused credentials
May expose sensitive resources
Can provide remote access
Are sometimes left unpatched
Are commonly misconfigured

Attackers typically enumerate these services during the reconnaissance phase to identify possible entry points into a system or network.

Defensive Measures¶

System administrators and security teams should secure these services by:

Disabling unused services
Applying regular security patches
Enforcing strong passwords
Enabling multi-factor authentication
Restricting remote access
Monitoring logs and authentication attempts
Using firewalls and network segmentation
Disabling SMBv1
Limiting RDP exposure to VPN-only access

Conclusion¶

Frequently exploited Windows services such as IIS, WebDAV, SMB, RDP, and WinRM are common attack surfaces in enterprise environments. Proper understanding of how these services operate, how attackers abuse them, and how defenders secure them is essential for both offensive and defensive cybersecurity professionals.

Penetration testers use these services for enumeration and exploitation during assessments, while blue team professionals monitor and harden them to prevent unauthorized access and lateral movement within a network.