Rpcbind

rpcbind maps ONC RPC program numbers to the network addresses where their services are listening. Clients query rpcbind on TCP or UDP port 111 to locate programs such as NFS and mountd, which may use dynamically assigned ports.

Connect

Confirm whether rpcbind responds over TCP or UDP port 111:

nmap -sS -sU -p 111 <target-ip>

Recon

Use service detection to identify rpcbind and the supported RPC protocol versions:

nmap -sV -p 111 <target-ip>

Enumeration

The rpcinfo utility lists registered RPC programs, their versions, transports, and assigned ports:

rpcinfo -p <target-ip>

Nmap's rpcinfo script provides the same mapping in scan output:

nmap -sV -p 111 --script=rpcinfo <target-ip>

Attack Vectors

Exposed RPC Programs

An exposed rpcbind service reveals which RPC programs are reachable, but that information alone is not proof of a vulnerability. Review each mapped program, version, transport, and port separately.

If rpcinfo reports NFS or mountd, enumerate the exports and continue with the NFS assessment workflow:

showmount -e <target-ip>

Post-Exploitation

rpcbind does not provide a generic authenticated shell or post-exploitation interface. Post-exploitation actions depend on the mapped RPC program. Use the program and version data from rpcinfo to continue with the relevant service-specific workflow.