According to this, they use port 135 and a dynamically assigned port above 1024, but that can also be manually configured.
http://technet.microsoft.com/en-us/library/cc758805(WS.10).aspxConfiguring dynamic RPC port:
http://support.microsoft.com/default.aspx?scid=kb;en-us;154596