# RPCBind / Portmapper

> RPC service mapper

- **URL:** https://hackindex.io/services/rpcbind-portmapper
- **Type:** Service
- **Default ports:** 111
- **Tags:** rpc, portmapper, linux, network, enumeration, service-discovery
- **Published:** 2026-01-26
- **Updated:** 2026-07-13

RPCBind (formerly Portmapper) maps RPC program numbers to network port numbers, allowing clients to locate RPC-based services such as NFS, NIS, and mountd. It listens on **TCP and UDP port 111**. Nmap identifies the service as `rpcbind`.

RPCBind is a gateway to discovering and attacking other RPC services on a host. By querying it, an attacker can enumerate every registered RPC program, its version, protocol, and port. This commonly reveals NFS exports, NIS domains, and other services that would otherwise require a full port scan to find. When NFS is registered, the path from RPCBind to mounting exported shares and accessing sensitive files is often short.

Enumeration starts with `rpcinfo -p <target>` to list all registered programs. Nmap's `rpcinfo` script provides the same output. From there, each discovered service can be probed individually. NFS exports are checked with `showmount -e`, and mountd can be used to mount shares remotely. Legacy RPC services like `rusersd`, `rstatd`, and `walld` occasionally appear and leak host information.

## Phases

- [Enumeration](https://hackindex.io/services/rpcbind-portmapper/enumeration.md): Guides for enumerating RPC programs and ports via rpcinfo (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/rpcbind-portmapper/vulnerability-discovery.md): Find dangerous RPC services via portmapper like NFS, NIS, rexd (1 guides)