> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 111 - Rpcbind

`Default Port: 111 (TCP and UDP)`

Rpcbind isn't a service you attack directly, it's a directory. ONC RPC programs like NFS, NIS, and mountd don't listen on fixed, predictable ports; instead they register themselves with rpcbind on startup, and clients query rpcbind first to find out which port a given program actually landed on. That makes rpcbind the map you check before enumerating anything else RPC-based on the host.

> [!TIP]
>
> The real value of rpcbind enumeration isn't rpcbind itself, it's what it points you toward. A host with NFS, NIS, or an rpc.statd service registered deserves a full enumeration pass against those services specifically, not just rpcbind.

***

## Recon

Rpcbind responds over both TCP and UDP, worth checking both since a firewall sometimes blocks one but not the other.

```bash theme={null}
nmap -sS -sU -p111 TARGET
nmap -sV -p111 TARGET
```

***

## Enumeration

`rpcinfo` is the standard tool for listing every RPC program registered with rpcbind, along with its version, transport, and the port it's actually listening on.

```bash theme={null}
rpcinfo -p TARGET
```

Nmap's `rpcinfo` script returns the same mapping as part of a broader scan:

```bash theme={null}
nmap -sV -p111 --script=rpcinfo TARGET
```

> [!NOTE]
>
> Typical output includes program number, version, protocol, port, and a human-readable name like `nfs`, `mountd`, `nlockmgr`, or `status`. That name is what tells you where to go next.

***

## Common Registered Programs

<table>
  <colgroup>
    <col width="164" />

    <col width="526" />
  </colgroup>

  <thead>
    <tr>
      <th>Program</th>
      <th>What It Means</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`nfs` / `mountd`</td>
      <td>NFS is running, go enumerate it directly ([NFS page](https://0-x.dev/title-111-and-2049-nfs-network-file-system-nfs-lets-a-unix-linux-host-mount-another-machines-directory-as-if-it-were-local-and-its-one-of-the-few-services-where-misconfiguration-alone-with-no-expl))</td>
    </tr>

    <tr>
      <td>`nlockmgr`</td>
      <td>NFS file locking, usually registered alongside NFS itself</td>
    </tr>

    <tr>
      <td>`status` (rpc.statd)</td>
      <td>Has a history of exploitable vulnerabilities on older Linux distributions</td>
    </tr>

    <tr>
      <td>`ypbind` / `ypserv`</td>
      <td>NIS (Network Information Service) is in use, worth enumerating for leaked user and password hash maps</td>
    </tr>
  </tbody>
</table>

***

## Following Up on NFS

If `rpcinfo` shows `nfs` or `mountd` registered, the natural next step is straight into NFS enumeration rather than anything further with rpcbind itself.

```bash theme={null}
showmount -e TARGET
```

> [!TIP]
>
> See the full [NFS cheatsheet](https://0-x.dev/title-111-and-2049-nfs-network-file-system-nfs-lets-a-unix-linux-host-mount-another-machines-directory-as-if-it-were-local-and-its-one-of-the-few-services-where-misconfiguration-alone-with-no-expl) for export enumeration, mounting, and the `no_root_squash` privilege escalation path, that's where the real impact from an exposed rpcbind/NFS pairing comes from.

***

## Quick Reference Tools

> **[Hackviser: Rpcbind](https://hackviser.com/tactics/pentesting/services/rpcbind)**
>
> Quick-reference pentesting guide for the Rpcbind service.

> **[HackTricks: Rpcbind](https://hacktricks.wiki/en/network-services-pentesting/pentesting-rpcbind.html)**
>
> Deeper breakdown of Rpcbind enumeration and related RPC services.

> [!WARNING]
>
> Rpcbind has no authenticated shell or exploitation surface of its own. Whatever action you take next depends entirely on which program it points you toward, treat the enumeration result as a lead, not a finding by itself.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.