Enumeration

RPCBind (portmapper) enumeration lists every RPC service registered on the target, mapping program numbers to ports and protocol versions. rpcinfo -p is the primary tool, returning the full registration table including NFS (program 100003), mountd (100005), NIS/ypserv (100004), statd, and lockd.

Each entry reveals the program number, version, protocol (TCP/UDP), and the high port the service listens on. This is valuable because many of these high-port services do not show up in standard port scans unless you know to look for them. Nmap's rpcinfo and rpc-grind scripts automate this and attempt to identify program names.

Focus on NFS, NIS, and mountd since these lead directly to file system access and credential harvesting. The presence of rusersd, rwalld, or sprayd indicates a system running legacy Sun RPC services that may have additional vulnerabilities. Document every registered program, you will reference this list during vulnerability discovery and exploitation of the individual services.