# Rpcbind Pentesting > How to enumerate and exploit RPCBind/Portmapper services (port 111) during network penetration testing. Use this skill whenever you're scanning a target and find port 111 open, or when you need to enumerate RPC services, NFS shares, or NIS domains. Trigger this skill for any RPC-related reconnaissance, NFS exploitation, NIS password extraction, or when port 111 appears filtered but you suspect RPC services are running. - Skill: `abelrguezr/rpcbind-pentesting` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add abelrguezr/rpcbind-pentesting` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/rpcbind-pentesting/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/abelrguezr/rpcbind-pentesting --- # RPCBind/Portmapper Pentesting ## What is RPCBind? **RPCBind** (also called **Portmapper**) is a service that maps network service ports to **RPC** (Remote Procedure Call) program numbers. It's a critical component in Unix-based systems that facilitates information exchange between systems. **Default ports:** 111/TCP/UDP (32771 in Oracle Solaris) **Why it matters:** Port 111 is frequently scanned by attackers because it reveals: - The type of Unix OS running - Available services on the system - NFS, NIS, and other RPC-based service details ## Enumeration Techniques ### Basic RPCInfo Enumeration Start with `rpcinfo` to list registered RPC services: ```bash # Basic enumeration rpcinfo rpcinfo -p # Example rpcinfo irked.htb rpcinfo -p 192.168.10.1 ``` ### Advanced RPCInfo Usage When TCP/111 is filtered, try UDP to pull the program list: ```bash # Pull UDP program list even when TCP/111 is filtered rpcinfo -T udp -p # Immediately check for world-readable NFS exports showmount -e ``` ### Nmap NSE Scripts Use Nmap's RPC scripts for exhaustive mapping: ```bash # Classic scan with RPC scripts nmap --script=rpcinfo,rpc-grind -p111 # Multi-threaded brute-force of RPC program numbers nmap --script=rpcinfo,rpc-grind --script-args 'rpc-grind.threads=8' -p111 # Basic port scan nmap -sSUC -p111 ``` **What `rpc-grind` does:** Hammers the portmapper with null calls that walk the `nmap-rpc` database, extracting supported versions when the remote daemon replies with "can't support version." This often reveals quietly registered services like `rusersd`, `rquotad`, or custom daemons. ### Shodan Search ```bash port:111 portmap ``` ## RPCBind + NFS Exploitation If you find NFS services registered through RPCBind, you can likely list and download (and possibly upload) files. ```bash # List NFS exports showmount -e # Mount NFS share mount -t nfs :/ /mnt/nfs # Or use nfsclient nfsclient :/ /mnt/nfs ``` **Note:** For detailed NFS exploitation techniques, see the NFS pentesting documentation. ## NIS (Network Information Service) Exploitation NIS vulnerabilities involve a two-step process: identify the `ypbind` service, then uncover the NIS domain name. ### Step 1: Install NIS Tools ```bash apt-get install nis ``` ### Step 2: Confirm NIS Server Presence ```bash # Ping the NIS server with domain name and server IP ypwhich -d ``` ### Step 3: Extract Sensitive Data ```bash # Extract user credentials (encrypted passwords) ypcat -d -h passwd.byname # Extract other maps ypcat -d -h hosts.byname ypcat -d -h group.byname ``` ### NIS Map Files Reference | Master File | Map(s) | Notes | |-------------|--------|-------| | /etc/hosts | hosts.byname, hosts.byaddr | Hostnames and IP details | | /etc/passwd | passwd.byname, passwd.byuid | NIS user password file | | /etc/group | group.byname, group.bygid | NIS group file | | /usr/lib/aliases | mail.aliases | Mail aliases | **After extraction:** Crack the password hashes using John the Ripper or Hashcat to reveal system access credentials. ## RPC Users Enumeration If you find the **rusersd** service listed in RPCInfo output, you can enumerate users on the target system. ```bash # Check for rusersd in rpcinfo output rpcinfo -p # Look for program 100003 (rusersd) ``` ## Bypassing Filtered Portmapper Port When port 111 is filtered but NFS ports are open, you can bypass the filter by simulating a portmapper service locally and creating a tunnel. **Technique:** 1. Simulate a portmapper service on your local machine 2. Create a tunnel from your machine to the target 3. Use standard tools to exploit the NFS services This allows exploitation even when port 111 appears filtered. ## Practical Examples ### Example 1: Basic Enumeration ```bash # Target: 10.10.10.10 rpcinfo -p 10.10.10.10 # Output might show: # program vers proto port service # 100000 2 tcp 111 portmapper # 100000 2 udp 111 portmapper # 100003 2 tcp 1026 rusersd # 100005 1 tcp 2049 nfs # 100005 1 udp 2049 nfs ``` ### Example 2: NIS Password Extraction ```bash # Install tools apt-get install nis # Find NIS domain and server ypwhich -d # Extract password hashes ypcat -d -h passwd.byname > passwd_hashes.txt # Crack with John john --wordlist=/usr/share/wordlists/rockyou.txt passwd_hashes.txt ``` ### Example 3: Nmap RPC Scan ```bash # Comprehensive RPC scan nmap --script=rpcinfo,rpc-grind --script-args 'rpc-grind.threads=8' -p111 192.168.1.100 # Output shows all registered RPC programs and versions ``` ## Common RPC Program Numbers | Program | Number | Service | |---------|--------|---------| | portmapper | 100000 | RPCBind | | rusersd | 100003 | Remote Users | | nfs | 100005 | Network File System | | mountd | 100005 | NFS Mount | | ypserv | 100004 | NIS Server | | ypbind | 100004 | NIS Client | ## Labs to Practice - **Irked HTB Machine:** Practice these techniques on the Irked HackTheBox machine ## Quick Reference Commands ```bash # Basic enumeration rpcinfo -p # UDP enumeration (when TCP filtered) rpcinfo -T udp -p # Nmap RPC scan nmap --script=rpcinfo,rpc-grind -p111 # NFS exports showmount -e # NIS password extraction ypcat -d -h passwd.byname # NIS server discovery ypwhich -d ``` ## References - [Nmap NSE: rpc-grind](https://nmap.org/nsedoc/scripts/rpc-grind.html) - [HackTricks RPCBind Pentesting](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-rpcbind.html) - [Bypass Filtered Portmapper](https://medium.com/@sebnemK/how-to-bypass-filtered-portmapper-port-111-27cee52416bc)