Port 32771 – Solaris RPC Portmapper (sunrpc High Port / rpcbind)

Port 32771 is the classic Solaris / SunOS “high” RPC port — the alternate address where Sun’s rpcbind/portmapper, and many of the RPC services it registers, can be reached in addition to the well-known port 111. On legacy Solaris, rpcbind listened on both 111 and a port in the roughly 32771–34000 range (Nmap labels these sometimes-rpc5, sometimes-rpc6, and so on). That second listener is a gift to an attacker: when a packet filter blocks 111 but forgets the high range, you can still ask the portmapper on 32771 which RPC programs are registered and on which ports — and then walk straight to whatever answers. That list often includes rstatd, rusersd, sprayd, mountd, and the trio with a long remote-root history: sadmind, rpc.cmsd (Calendar Manager), and rpc.ttdbserverd (the ToolTalk database server). On an open 32771 the job isn’t to attack “port 32771” — it’s to enumerate the RPC service map behind it and assess each registered program.

Why It’s Open

SunRPC (ONC RPC) doesn’t give each service a fixed port. Instead, RPC programs register with the portmapper (rpcbind), which hands out a dynamic port and answers the question “where is program number X?” On Solaris and SunOS, that dynamic range historically started at 32771, and — critically — rpcbind itself also answered on a high port in that range, not only on 111. So an open 32771 usually means one of two things: the portmapper is reachable there directly, or a specific RPC daemon (sadmind, cmsd, ToolTalk, a status/user daemon, or mountd/nfsd for NFS on 2049) has been assigned that port.

This is legacy UNIX territory — the opposite end of the RPC world from the Microsoft RPC endpoint mapper on port 135. It survives on old Solaris/SunOS servers still racked in datacenters, on appliances built on those OSes, and on any host where firewall rules were written for 111 but never extended to the high RPC range. The whole reason the port matters to a pentester is that it defeats the naive “just block 111” control: the RPC service map is still one rpcinfo query away.

Common Risks

• Firewall-bypass enumeration. Blocking port 111 while leaving the high RPC range open lets an attacker query the portmapper on 32771 and recover the full list of registered RPC programs and ports — the exact map they need to pick a target.
• Remote-root RPC daemons. Several of the services reachable this way (sadmind, rpc.cmsd, ToolTalk rpc.ttdbserverd) have classic pre-authentication buffer-overflow and format-string bugs that yield remote root (see CVEs below).
• Weak AUTH_SYS authentication. sadmind’s default AUTH_SYS “authentication” is trivially spoofable, so a client can impersonate an admin and run commands as root with no password at all.
• Information disclosure. rusersd and rstatd hand out logged-in usernames and system statistics to anyone who asks, and rpcinfo itself reveals the entire service inventory — a fingerprint of exactly what to exploit.
• NFS exposure. If mountd/nfsd are registered, the same enumeration exposes exported filesystems, which may be world-readable or writable.
• Automated / worm exploitation. These bugs were weaponised long ago and folded into worms and Metasploit; an exposed legacy Solaris host is a well-trodden target, not a novel one.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

The whole point of an open 32771 is that it lets you query the portmapper even when 111 is filtered. Start there, then branch on whatever RPC programs come back.

List registered RPC programs via the high portmapper

# Ask the portmapper for its full program/port map
rpcinfo -p <target>

# Aim explicitly at the high RPC port over UDP and TCP
rpcinfo -T udp <target> 32771
rpcinfo -T tcp <target> 32771

Version + RPC scan with Nmap

# -sV runs Nmap's RPC "grinder" automatically; rpcinfo dumps the program table
nmap -sSU -sV -p 111,32771 --script rpcinfo <target>

# Fingerprint an unknown RPC port (program number + version) directly
nmap -p 32771 --script rpc-grind <target>

If NFS turns up in the map, enumerate exports

nmap -sV --script "nfs-showmount,nfs-ls,nfs-statfs" -p 32771,2049 <target>
showmount -e <target>

Enumerate and exploit with Metasploit

msfconsole -q
use auxiliary/scanner/misc/sunrpc_portmapper
set RHOSTS <target>
run

# sadmind weak-auth command execution (CVE-2003-0722)
use exploit/solaris/sunrpc/sadmind_exec
set RHOSTS <target>
run

The exploit/solaris/sunrpc/sadmind_adm_build_path module (a separate sadmind overflow) and the ToolTalk module exploit/aix/rpc_ttdbserverd_realpath also live in the framework if those daemons appear. Record every open 32771, the full rpcinfo program map, and any service you positively identify, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

There is no single “port 32771” CVE — the risk lives in whichever RPC program the portmapper points you to. Every CVE below was checked against its NVD record and kept only where the affected service genuinely registers with the RPC portmapper and is therefore reachable through a 32771 enumeration:

• CVE-1999-0977 — Buffer overflow in Solaris sadmind via a NETMGT_PROC_SERVICE request gives remote attackers root. CVSS 10.0. This is the flaw the Sadmind/IIS worm rode in 2001.
• CVE-2003-0722 — The default sadmind install on Solaris uses weak AUTH_SYS authentication, letting a remote attacker spoof a Solstice AdminSuite client and gain root via a crafted RPC sequence. CVSS 10.0. Weaponised as Metasploit exploit/solaris/sunrpc/sadmind_exec.
• CVE-1999-0003 — Buffer overflow in the ToolTalk database server rpc.ttdbserverd executes commands as root on Solaris/SunOS (and SGI). CVSS 10.0. The archetypal UNIX RPC remote-root.
• CVE-2001-0717 — Format-string vulnerability in rpc.ttdbserverd: attacker-controlled format specifiers reach syslog, enabling arbitrary command execution. CVSS 10.0. (Some references file this under Calendar Manager — NVD shows it is ToolTalk.) The related ToolTalk _tt_internal_realpath overflow ships as Metasploit exploit/aix/rpc_ttdbserverd_realpath and Exploit-DB 16930 (AIX target); a Solaris rpc.ttdbserver denial-of-service PoC is archived as Exploit-DB 19635.
• CVE-2002-0391 — Integer overflow in the xdr_array function of SunRPC-derived RPC servers (libc/glibc/dietlibc), exploitable through RPC services such as rpc.cmsd and dmispd to run arbitrary code. CVSS v2 10.0 / v3.1 9.8. This is the genuine Calendar Manager remote-code-execution surface.
• CVE-1999-0002 — Buffer overflow in NFS mountd gives remote root, predominantly on Linux NFS servers. CVSS 10.0. mountd registers with the portmapper, so it appears in the same rpcinfo -p map and is reachable via the same technique — a reminder that portmapper enumeration surfaces every registered program, not only the Solaris-specific daemons. See NFS on port 2049.

Removed / not included: CVE-2001-0803 is frequently lumped in with “ToolTalk” write-ups, but its NVD record shows it is a buffer overflow in libDtSvc.so.1 in the CDE Subprocess Control Service (dtspcd) — a standalone service on TCP 6112, not an RPC program registered with the portmapper. Because it isn’t reachable through a 32771 rpcinfo query, it doesn’t belong on this page and is deliberately left off. Always confirm the affected product on NVD and check that it actually registers with rpcbind before treating a CVE as “port 32771”.

Mitigation

• Firewall the whole RPC range, not just 111. Blocking port 111 while leaving 32771–34000 open is the mistake this port exists to punish — restrict both the portmapper and the dynamic high range to trusted management networks.
• Disable RPC services you don’t need. sadmind, rpc.cmsd, ToolTalk (rpc.ttdbserverd), rusersd, rstatd and sprayd are rarely required on a modern host — turn them off in inetd.conf/SMF rather than leaving them registered.
• Patch or retire legacy Solaris/SunOS. The daemons behind these bugs belong to end-of-life platforms; where they must stay, apply the vendor patches and, for sadmind, move off the default weak AUTH_SYS to strong AUTH_DES authentication.
• Lock down NFS. If mountd/nfsd are exposed, tighten exports, avoid world-readable/writable shares, and restrict clients by host.
• Rescan to confirm. After disabling services, re-run rpcinfo -p <target> and nmap -sSU -sV -p 111,32771 <target> to verify the program map is empty and the high port is closed.

Real-World Example

The Sadmind/IIS worm of 2001 is the canonical port-32771-style incident. It first exploited the Solaris sadmind buffer overflow (CVE-1999-0977) — an RPC service an attacker locates by querying the portmapper — to gain root on vulnerable Sun boxes, then used those compromised hosts to deface Microsoft IIS web servers via a separate directory-traversal bug. It spread automatically, with no user interaction, precisely because reaching sadmind was as simple as asking the portmapper where it was registered and firing a single malformed RPC call. The lesson holds today: an open high RPC port is an inventory service that hands an attacker a menu of daemons, and on legacy Solaris that menu has included several one-shot remote-root bugs. Enumerate the map before assuming the port is harmless.

FAQ

What is port 32771 used for?

Port 32771 is the start of the traditional Solaris/SunOS dynamic RPC port range and, on legacy Solaris, an alternate address for the rpcbind/portmapper itself. RPC programs — sadmind, rpc.cmsd, ToolTalk (rpc.ttdbserverd), rstatd, rusersd, and NFS’s mountd/nfsd — register with the portmapper, which assigns them ports in this high range. Querying it with rpcinfo reveals which services are running and where.

Why is port 32771 open on my server?

Almost always because it’s a Solaris/SunOS-derived host running SunRPC services. Either the portmapper is answering on the high port (in addition to 111) or a specific RPC daemon was assigned a port at the bottom of the dynamic range. If you don’t run any RPC services, an open 32771 usually means a legacy daemon is still enabled — enumerate it with rpcinfo -p and disable what you find.

How is port 32771 used to bypass firewalls?

Many old rule sets block the well-known portmapper on port 111 but leave the high RPC range reachable. Because Solaris rpcbind also listened on ~32771, an attacker who can’t query 111 can still run rpcinfo -T udp <target> 32771 to pull the full RPC program map, then connect straight to whatever daemon is registered — defeating a control that only ever considered port 111.

Which services on port 32771 are actually dangerous?

The high-risk ones are sadmind (remote-root overflow and a spoofable default AUTH_SYS), rpc.cmsd (the xdr_array integer overflow, CVE-2002-0391), and rpc.ttdbserverd / ToolTalk (buffer-overflow and format-string RCE). rusersd and rstatd are lower severity but leak usernames and host details that help an attacker pick a target.

Is port 32771 the same as the RPC endpoint mapper on port 135?

No. Port 32771 is the UNIX SunRPC / ONC RPC portmapper world (Solaris, SunOS); the Microsoft RPC endpoint mapper on port 135 is the Windows equivalent. Both answer “where is service X?”, but they use different protocols, services, and exploits.

How do I secure or close port 32771?

Disable the RPC services you don’t need (inetd.conf/SMF), patch or retire the legacy Solaris/SunOS hosts that run them, move sadmind off weak AUTH_SYS, and firewall both port 111 and the 32771–34000 range to trusted networks. Then confirm with rpcinfo -p <target> that no unwanted programs remain registered and rescan the high port.

TL;DR

• Service: Solaris/SunOS SunRPC portmapper (rpcbind) on the high “sunrpc” port, plus registered RPC daemons — sadmind, rpc.cmsd, ToolTalk (rpc.ttdbserverd), rstatd, rusersd, mountd/nfsd
• Default port: 32771/TCP and 32771/UDP (top of the legacy dynamic RPC range, ~32771–34000; mirrors port 111)
• Biggest risk: querying the portmapper here bypasses firewalls that only block 111 and hands an attacker the RPC service map — including remote-root daemons (sadmind CVE-1999-0977/CVE-2003-0722, ToolTalk CVE-1999-0003/CVE-2001-0717, rpc.cmsd CVE-2002-0391)
• Mitigation: disable unneeded RPC services, patch/retire legacy Solaris, drop sadmind’s weak AUTH_SYS, and firewall both 111 and the high RPC range, then rescan with rpcinfo -p