# RPC Program Enumeration with rpcinfo

- **URL:** https://hackindex.io/services/rpcbind-portmapper/enumeration/rpc-program-enumeration-with-rpcinfo
- **Path:** RPCBind / Portmapper > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/rpcbind-portmapper/enumeration.md)
- **Published:** 2026-01-26
- **Updated:** 2026-03-30

RPCBind (portmapper) on port 111 is a directory service for RPC programs. Its value is not in the portmapper itself but in the list of programs it returns: each entry maps a program name to a dynamically assigned port. NFS, mountd, NIS/YP, and other RPC services register here on startup. Every non-111 port in the output is real attack surface that must be scanned and identified. Move to [exposed services assessment](https://hackindex.io/services/rpcbind-portmapper/vulnerability-discovery/rpcbind-exposed-services) after building the full port list.

- Fast Program Listing
- TCP vs UDP: When Results Look Incomplete
- nmap rpcinfo Script
- Pivot Scan: Service Detection on Discovered Ports
- Program Name Reference

## Fast Program Listing

```bash
rpcinfo -p $TARGET_IP
# program vers proto   port  service
# 100000    4   tcp    111  rpcbind
# 100000    3   udp    111  rpcbind
# 100003    3   tcp   2049  nfs
# 100003    4   tcp   2049  nfs
# 100005    1   tcp  43577  mountd
# 100005    3   udp  38297  mountd
# 100024    1   udp  35147  status
# 100021    4   tcp  36921  nlockmgr
```

Every non-111 port in this output is a service running on a dynamic port. Add all of them to your scan targets immediately. The program name in the rightmost column tells you what to investigate next: `mountd` alongside `nfs` is the most common high-value finding and leads directly to [NFS enumeration](https://hackindex.io/services/nfs/enumeration/nfs-export-discovery).

## TCP vs UDP: When Results Look Incomplete

If the default query returns partial results or times out, query each transport explicitly:

```bash
rpcinfo -T tcp -p $TARGET_IP
```

```bash
rpcinfo -T udp -p $TARGET_IP
```

TCP succeeds but UDP fails when UDP is filtered: still useful, pivot off the TCP-registered ports. Both failing means port 111 may not be reachable from your current position or is firewalled. Verify with a direct nc probe:

```bash
nc -zv $TARGET_IP 111 && echo 'reachable' || echo 'filtered'
# reachable
```

## nmap rpcinfo Script

Useful when rpcinfo is not installed locally or you want the output in a consistent nmap format:

```bash
nmap -sV -p 111 --script rpcinfo $TARGET_IP
# | rpcinfo:
# |   program version  port/proto  service
# |   100000  2,3,4     111/tcp    rpcbind
# |   100003  3,4       2049/tcp   nfs
# |   100005  1,2,3     43577/tcp  mountd
# |   100021  1,3,4     36921/tcp  nlockmgr
# |_  100024  1         35147/udp  status
```

```bash
sudo nmap -sU -p 111 --script rpcinfo $TARGET_IP
```

## Pivot Scan: Service Detection on Discovered Ports

Take every non-111 port from the rpcinfo output and run service detection against them directly:

```bash
PORTS=$(rpcinfo -p $TARGET_IP 2>/dev/null | awk 'NR>1 && $4 != 111 {print $4}' | sort -u | tr '\n' ',')
nmap -sV -p $PORTS $TARGET_IP
# 2049/tcp  open  nfs      3-4 (RPC #100003)
# 36921/tcp open  nlockmgr 1-4 (RPC #100021)
# 43577/tcp open  mountd   1-3 (RPC #100005)
```

## Program Name Reference

Common RPC programs and what each means for next steps:

| Program | Service | Next step |
| --- | --- | --- |
| nfs (100003) | NFS file server | NFS export enumeration, mount without auth |
| mountd (100005) | NFS mount daemon | showmount -e, list exports |
| nlockmgr (100021) | NFS lock manager | Supports NFS stack, enumerate alongside nfs |
| status (100024) | NSM status monitor | Supports NFS stack |
| ypserv (100004) | NIS/YP server | NIS domain enumeration, ypcat passwd |
| ypbind (100007) | NIS/YP bind | Confirms NIS client, enumerate domain |
| rexd (100017) | Remote execution | High priority: often unauthenticated RCE |
| walld (100008) | Wall broadcast | Low value, note and move on |

Move to [exposed services assessment](https://hackindex.io/services/rpcbind-portmapper/vulnerability-discovery/rpcbind-exposed-services) to evaluate what the discovered programs expose, then pivot into the appropriate service pages for exploitation.

## References

- [nmap: rpcinfo NSE](https://nmap.org/nsedoc/scripts/rpcinfo.html) - Script behavior and output fields for RPC program enumeration