Skip to content
HackIndex.io

RPC Program Enumeration with rpcinfo

3 min read Created Jan 26, 2026 Last updated Mar 30, 2026

RPCBind (portmapper) on port 111 is a directory service for RPC programs. Its value is not in the portmapper itself but in the list of programs it returns: each entry maps a program name to a dynamically assigned port. NFS, mountd, NIS/YP, and other RPC services register here on startup. Every non-111 port in the output is real attack surface that must be scanned and identified. Move to exposed services assessment after building the full port list.

  • Fast Program Listing
  • TCP vs UDP: When Results Look Incomplete
  • nmap rpcinfo Script
  • Pivot Scan: Service Detection on Discovered Ports
  • Program Name Reference

Fast Program Listing

┌──(kali㉿kali)-[~]
└─$ rpcinfo -p $TARGET_IP 
program vers proto   port  service
100000    4   tcp    111  rpcbind
100000    3   udp    111  rpcbind
100003    3   tcp   2049  nfs
100003    4   tcp   2049  nfs
100005    1   tcp  43577  mountd
100005    3   udp  38297  mountd
100024    1   udp  35147  status
100021    4   tcp  36921  nlockmgr

Every non-111 port in this output is a service running on a dynamic port. Add all of them to your scan targets immediately. The program name in the rightmost column tells you what to investigate next: mountd alongside nfs is the most common high-value finding and leads directly to NFS enumeration.

TCP vs UDP: When Results Look Incomplete

If the default query returns partial results or times out, query each transport explicitly:

┌──(kali㉿kali)-[~]
└─$ rpcinfo -T tcp -p $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ rpcinfo -T udp -p $TARGET_IP

TCP succeeds but UDP fails when UDP is filtered: still useful, pivot off the TCP-registered ports. Both failing means port 111 may not be reachable from your current position or is firewalled. Verify with a direct nc probe:

┌──(kali㉿kali)-[~]
└─$ nc -zv $TARGET_IP 111 && echo 'reachable' || echo 'filtered' 
reachable

nmap rpcinfo Script

Useful when rpcinfo is not installed locally or you want the output in a consistent nmap format:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 111 --script rpcinfo $TARGET_IP 
| rpcinfo:
|   program version  port/proto  service
|   100000  2,3,4     111/tcp    rpcbind
|   100003  3,4       2049/tcp   nfs
|   100005  1,2,3     43577/tcp  mountd
|   100021  1,3,4     36921/tcp  nlockmgr
|_  100024  1         35147/udp  status
┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 111 --script rpcinfo $TARGET_IP

Pivot Scan: Service Detection on Discovered Ports

Take every non-111 port from the rpcinfo output and run service detection against them directly:

┌──(kali㉿kali)-[~]
└─$ PORTS=$(rpcinfo -p $TARGET_IP 2>/dev/null | awk 'NR>1 && $4 != 111 {print $4}' | sort -u | tr '\n' ',')
┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORTS $TARGET_IP 
2049/tcp  open  nfs      3-4 (RPC #100003)
36921/tcp open  nlockmgr 1-4 (RPC #100021)
43577/tcp open  mountd   1-3 (RPC #100005)

Program Name Reference

Common RPC programs and what each means for next steps:

Program

Service

Next step

nfs (100003)

NFS file server

NFS export enumeration, mount without auth

mountd (100005)

NFS mount daemon

showmount -e, list exports

nlockmgr (100021)

NFS lock manager

Supports NFS stack, enumerate alongside nfs

status (100024)

NSM status monitor

Supports NFS stack

ypserv (100004)

NIS/YP server

NIS domain enumeration, ypcat passwd

ypbind (100007)

NIS/YP bind

Confirms NIS client, enumerate domain

rexd (100017)

Remote execution

High priority: often unauthenticated RCE

walld (100008)

Wall broadcast

Low value, note and move on

Move to exposed services assessment to evaluate what the discovered programs expose, then pivot into the appropriate service pages for exploitation.

References