RPCBind / Portmapper

RPCBind (formerly Portmapper) maps RPC program numbers to network port numbers, allowing clients to locate RPC-based services such as NFS, NIS, and mountd. It listens on TCP and UDP port 111. Nmap identifies the service as rpcbind.

RPCBind is a gateway to discovering and attacking other RPC services on a host. By querying it, an attacker can enumerate every registered RPC program, its version, protocol, and port. This commonly reveals NFS exports, NIS domains, and other services that would otherwise require a full port scan to find. When NFS is registered, the path from RPCBind to mounting exported shares and accessing sensitive files is often short.

Enumeration starts with rpcinfo -p <target> to list all registered programs. Nmap's rpcinfo script provides the same output. From there, each discovered service can be probed individually. NFS exports are checked with showmount -e, and mountd can be used to mount shares remotely. Legacy RPC services like rusersd, rstatd, and walld occasionally appear and leak host information.