Skip to main content
Default Port: 111 (TCP and UDP) Rpcbind isn’t a service you attack directly, it’s a directory. ONC RPC programs like NFS, NIS, and mountd don’t listen on fixed, predictable ports; instead they register themselves with rpcbind on startup, and clients query rpcbind first to find out which port a given program actually landed on. That makes rpcbind the map you check before enumerating anything else RPC-based on the host.
The real value of rpcbind enumeration isn’t rpcbind itself, it’s what it points you toward. A host with NFS, NIS, or an rpc.statd service registered deserves a full enumeration pass against those services specifically, not just rpcbind.

​
Recon

Rpcbind responds over both TCP and UDP, worth checking both since a firewall sometimes blocks one but not the other.

​
Enumeration

rpcinfo is the standard tool for listing every RPC program registered with rpcbind, along with its version, transport, and the port it’s actually listening on.
Nmap’s rpcinfo script returns the same mapping as part of a broader scan:
Typical output includes program number, version, protocol, port, and a human-readable name like nfs, mountd, nlockmgr, or status. That name is what tells you where to go next.

​
Common Registered Programs

ProgramWhat It Means
nfs / mountdNFS is running, go enumerate it directly (NFS page)
nlockmgrNFS file locking, usually registered alongside NFS itself
status (rpc.statd)Has a history of exploitable vulnerabilities on older Linux distributions
ypbind / ypservNIS (Network Information Service) is in use, worth enumerating for leaked user and password hash maps

​
Following Up on NFS

If rpcinfo shows nfs or mountd registered, the natural next step is straight into NFS enumeration rather than anything further with rpcbind itself.
See the full NFS cheatsheet for export enumeration, mounting, and the no_root_squash privilege escalation path, that’s where the real impact from an exposed rpcbind/NFS pairing comes from.

​
Quick Reference Tools

Hackviser: Rpcbind

Quick-reference pentesting guide for the Rpcbind service.

HackTricks: Rpcbind

Deeper breakdown of Rpcbind enumeration and related RPC services.
Rpcbind has no authenticated shell or exploitation surface of its own. Whatever action you take next depends entirely on which program it points you toward, treat the enumeration result as a lead, not a finding by itself.