No such service exists, for all intents and purposes, whois privacy cannot be bypassed.
For registrar-owned brokers (e.g: GoDaddy's Domain Broker Service) they have access to their own internal customer details which are
not whois details, e.g: if "example.com" is registered with GoDaddy then a GoDaddy broker can find the email address of the customer (without access to whois). For non-registrar-owned brokers, they're using various strategies to track down owners.
Whois
history can be very useful because many of the most valuable domains were registered before whois privacy was widespread. You can use DomainTools, Whoxy, and various other providers for whois history. If you can't track down details via Whois history: even if a domain isn't in use today, it was probably registered to be used and so the internet archive will often have at least one page that provides identifiable information. You can also try various email lookup tools, looking for "@example.com" email addresses. Current and historic DNS records, domains on the same server etc. can be useful too.
You will also find that many registrars provide whois contact forms: if you go to the whois lookup offered by the domain's registrar (not a third-party whois service) you may find a contact link. GoDaddy, for example, have a
"Contact Domain Holder" link at the bottom.
Often, you may think you're failing to reach the owner by using anonymous email addresses available in whois, but your emails
are making it to the inbox of the person who owns the domain... they're just being ignored. The strategy employed by DomainAgents (paying domain owners to respond to their emails) is quite effective at overcoming that.
Ultimately it comes down to the specific domain, but as a general rule, regardless of current whois details, it should be possible to get in touch with the owner.