> For the complete documentation index, see [llms.txt](https://docs.h4rithd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.h4rithd.com/tcp/2049-nfs.md).

# RPC & NFS | 111, 2049

### 01. Basic Enumerations

```bash
## ------------------| Nmap Scan
sudo nmap --script nfs* -sV -p111,2049 $IP

## ------------------| List mounts
showmount -e $IP

## ------------------| List both the client and hostname or IP
showmount -a $IP
```

### 02. Mount option

```bash
sudo mkdir -p /mnt/remote
sudo mount -t nfs $IP:/ /mnt/remote
sudo mount -t nfs $IP:/ /mnt/remote -o nolock
sudo mount -t nfs $IP:/site_backups /mnt/remote
sudo mount -t nfs $IP:/site_backups /mnt/remote -o nolock
```

### 03. Privilege Escalation

```bash
### If the “no_root_squash” option is present on a writable share, we can create an executable with SUID bit set and run it on the target system         
## ------------------| Check if no_root_squash is present?
cat /etc/exports | grep no_root_squash

## ------------------| List mounts and mount it to our local machine
showmount -e $IP
sudo mkdir -p /mnt/new
sudo mount -t nfs $IP:/<WritableShares> /mnt/new
sudo mount -t nfs -o vers=2 $IP:/<WritableShares> /mnt/new

### Create a SUID binary and place it. then execuite it via attackers machine.
```