On 2026-06-02, I ran masscan against the Proxmox node:

sudo masscan [PROXMOX_IP] --ports 0-65535
Discovered open port 3128/tcp on [PROXMOX_IP]
Discovered open port 111/tcp on [PROXMOX_IP]
Discovered open port 8006/tcp on [PROXMOX_IP]
Discovered open port 22/tcp on [PROXMOX_IP]

Port 111 serves rpcbind. Less than 48 hours earlier, I had exploited an rpcbind vulnerability on Kenobi, a TryHackMe box where port 111 was the entry point to an NFS export that handed over an SSH private key. Finding the same port open on my own node was not something I was going to leave alone.

Checked what was using it:

ss -tulpn
systemctl list-dependencies rpcbind

Nothing in the lab required rpcbind. Disabled it:

systemctl disable --now rpcbind.service rpcbind.socket
systemctl stop rpcbind.socket
systemctl stop rpcbind.service
ss -tulpn | grep ':111'

No output. Port 111 closed.

The same tool I used on Game Zone to find a hidden Webmin service, ss -tulpn, was the diagnostic that confirmed rpcbind’s dependencies before pulling it. Knowing how to exploit a service and knowing how to find it running on your own infrastructure are two sides of the same skill.

This is what a home lab is for.