Skip to main content

Want to Practice These Techniques?

Try Hackviser's interactive cyber security upskilling platform - Learn by doing!

Start Practicing Now

Rpcbind

Default Port: 111

rpcbind maps ONC RPC program numbers to the network addresses where their services are listening. Clients query rpcbind on TCP or UDP port 111 to locate programs such as NFS and mountd, which may use dynamically assigned ports.

Connect​

Confirm whether rpcbind responds over TCP or UDP port 111:

nmap -sS -sU -p 111 <target-ip>

Recon​

Use service detection to identify rpcbind and the supported RPC protocol versions:

nmap -sV -p 111 <target-ip>

Enumeration​

The rpcinfo utility lists registered RPC programs, their versions, transports, and assigned ports:

rpcinfo -p <target-ip>

Nmap's rpcinfo script provides the same mapping in scan output:

nmap -sV -p 111 --script=rpcinfo <target-ip>

Attack Vectors​

Exposed RPC Programs​

An exposed rpcbind service reveals which RPC programs are reachable, but that information alone is not proof of a vulnerability. Review each mapped program, version, transport, and port separately.

If rpcinfo reports NFS or mountd, enumerate the exports and continue with the NFS assessment workflow:

showmount -e <target-ip>

Post-Exploitation​

rpcbind does not provide a generic authenticated shell or post-exploitation interface. Post-exploitation actions depend on the mapped RPC program. Use the program and version data from rpcinfo to continue with the relevant service-specific workflow.