312-50 Question 102
Single answer▪ Other Enumeration Techniques (IPsec, VoIP, RPC,During an authorized internal assessment, you discover that a Linux-based server exposes TCP 111 (rpcbind/portmapper) and several high-numbered TCP ports. The target appears to host legacy NFS services, but the firewall blocks most direct probes. You need to enumerate available RPC programs and determine which services are registered so you can identify likely attack paths without exploiting the host. Which action is the most appropriate next step?
- A
Use rpcinfo against the target to query the portmapper and list registered RPC programs and their associated ports
- B
Send SIP OPTIONS requests to the host to identify VoIP extensions and map registered users
- C
Run ike-scan against the target to enumerate IPsec transform sets and pre-shared keys
- D
Perform an SNMP walk on UDP 161 to enumerate exported file systems and RPC services
Show answer and explanation
Correct answer: A
Explanation
The key clue is the presence of TCP 111, which indicates rpcbind/portmapper. In Unix/Linux environments, RPC-based services such as NFS and related daemons often register with rpcbind and may use dynamically assigned high ports. Enumerating those registrations is a standard reconnaissance technique because it helps identify exposed services even when direct probing is restricted. The best next step is to query the portmapper with rpcinfo, which can reveal program numbers, versions, transport protocols, and bound ports.
This aligns with common Unix/Linux administration and security practices around ONC RPC and NFS troubleshooting. rpcinfo is the appropriate utility for listing registered RPC services, while tools like ike-scan and SIP probes apply to different enumeration domains entirely: IPsec/IKE and VoIP/SIP, respectively. SNMP can be useful in broader enumeration if available, but it is not the direct or most efficient method for discovering RPC program mappings from a host already known to expose rpcbind.
References: rpcinfo and rpcbind manual pages on Linux/Unix systems; NFS/rpcbind operational documentation; standard network service enumeration methodology used in penetration testing.
- A. Correct.
Correct. rpcinfo is specifically designed to query rpcbind/portmapper on systems exposing RPC services. In a scenario where TCP 111 is open, rpcinfo can enumerate registered RPC program numbers, versions, protocols, and mapped ports. This is a standard and non-exploitative enumeration step for identifying services such as mountd, nlockmgr, status, and NFS-related daemons that may be listening on dynamic high ports.
- B. Incorrect.
Incorrect. SIP OPTIONS is used in VoIP enumeration to identify SIP endpoints, capabilities, or PBX behavior, typically on SIP services such as UDP/TCP 5060 or 5061. It is not relevant to enumerating RPC services exposed through rpcbind on TCP 111. This distractor reflects confusion between VoIP enumeration and RPC enumeration.
- C. Incorrect.
Incorrect. ike-scan is used for IPsec/IKE enumeration, typically against UDP 500 and sometimes UDP 4500 for NAT-T, to identify VPN gateways, IKE versions, and certain policy details. It does not query RPC portmapper services and cannot enumerate RPC program registrations on TCP 111. The mention of pre-shared keys is also misleading because ike-scan does not simply retrieve PSKs from a compliant target.
- D. Incorrect.
Incorrect. SNMP walk can enumerate management information only if SNMP is enabled and accessible on UDP 161 with a valid community string or credentials. It does not directly query rpcbind to list RPC program mappings. While SNMP may reveal host configuration in some environments, it is not the most appropriate next step for RPC-specific enumeration in this scenario.