4.10.11. Message Queuing and Distributed Transaction Coordinator services

The Message Queuing service (msmq) runs RPC services, listening on the ncacn_ip_tcp transport. By default, the msmq services opens 4 TCP ports [81], including one or several of 2101/tcp, 2103/tcp, 2105/tcp and 2107/tcp.

The mqqm.dll (Windows NT MQ Queue Manager) DLL, loaded in the mqsvc.exe process, contains the following RPC services:

fdb3a030-065f-11d1-bb9b-00a024ea5525 v1.0
76d12b80-3467-11d3-91ff-0090272f9ea3 v1.0
1088a980-eae5-11d0-8d9b-00a02453c337 v1.0
5b5b3580-b0e0-11d1-b92d-0060081e87f0 v1.0
41208ee0-e970-11d1-9b9e-00e02c064c39 v1.0

Table 4.49. qmcomm operations

InterfaceOperation numberOperation name
fdb3a030-065f-11d1-bb9b-00a024ea5525 v1.0: qmcomm  
 0x00QMOpenQueue
 0x01QMGetRemoteQueueName
 0x02QMOpenRemoteQueue
 0x03QMCloseRemoteQueueContext
 0x04QMCreateRemoteCursor
 0x05QMSendMessageInternal
 0x06QMCreateObjectInternal
 0x07QMSetObjectSecurityInternal
 0x08QMGetObjectSecurityInternal
 0x09QMDeleteObject
 0x0aQMGetObjectProperties
 0x0bQMSetObjectProperties
 0x0cQMObjectPathToObjectFormat
 0x0dQMAttachProcess
 0x0eQMGetTmWhereabouts
 0x0fQMEnlistTransation
 0x10QMEnlistInternalTransaction
 0x11QMCommitTransaction
 0x12QMAbortTransaction
 0x13QMOpenQueueInternal
 0x14ACCloseHandle
 0x15ACCreateCursor
 0x16ACCloseCursor
 0x17ACSetCursorProperties
 0x18ACSendMessage
 0x19ACReceiveMessage
 0x1aACHandleToFormatName
 0x1bACPurgeQueue
 0x1cQMQueryQMRegistryInternal
 0x1dQMListInternalQueues
 0x1eQMCorrectOutSequence
 0x1fQMGetRemoteQMServerPort
 0x20QMGetMsmqServiceName
 0x21QMCreateDSObjectInternal

A vulnerability in the QMDeleteObject operation was discovered by Kostya Kortchinsky and fixed by the MS05-017 security bulletin [82] in April 2005.

Table 4.50. qmcomm2 operations

InterfaceOperation numberOperation name
76d12b80-3467-11d3-91ff-0090272f9ea3 v1.0: qmcomm2  
 0x00QMSendMessageInternalEx
 0x01ACSendMessageEx
 0x02ACReceiveMessageEx
 0x03ACCreateCursorEx

Table 4.51. qm2qm operations

InterfaceOperation numberOperation name
1088a980-eae5-11d0-8d9b-00a02453c337 v1.0: qm2qm  
 0x00RemoteQMStartReceive
 0x01RemoteQMEndReceive
 0x02RemoteQMOpenQueue
 0x03RemoteQMCloseQueue
 0x04RemoteQMCloseCursor
 0x05RemoteQMCancelReceive
 0x06RemoteQMPurgeQueue
 0x07RemoteQMGetQMQMServerPort
 0x08RemoteQmGetVersion
 0x09RemoteQMStartReceive2
 0x0aRemoteQMStartReceiveByLookupId

Table 4.52. qmrepl operations

InterfaceOperation numberOperation name
5b5b3580-b0e0-11d1-b92d-0060081e87f0 v1.0: qmrepl  
 0x00QMSendReplMsg

Table 4.53. qmmgmt operations

InterfaceOperation numberOperation name
41208ee0-e970-11d1-9b9e-00e02c064c39 v1.0: qmmgmt  
 0x00QMMgmtGetInfo
 0x01QMMgmtAction

The msdtcprx.dll (MS DTC OLE Transactions interface proxy) DLL, also loaded in the mqsvc.exe process, also contains one RPC service:

906b0ce0-c70b-1067-b317-00dd010662da v1.0

Table 4.54. IXnRemote operations

InterfaceOperation numberOperation name
906b0ce0-c70b-1067-b317-00dd010662da v1.0: IXnRemote  
 0x00Poke
 0x01BuildContext
 0x02NegotiateResources
 0x03SendReceive
 0x04TearDownContext
 0x05BeginTearDown
 0x06PokeW
 0x07BuildContextW

This RPC service also runs in the Distributed Transaction Coordinator service process (msdtc.exe), which opens a dynamic port, as well as TCP port 3372 (at least on Windows 2000)