This Metasploit module discloses the NIS domain name from bootparamd. You must know a client address from the targets bootparams file. Hint: try hosts within the same network range as the target.
032207ea0aee88f1156d7b493201d4bf12041304c67f91dbb7c1df8fec2f8448