🥷
Penetration Testing Notes
Home
  • Notes
  • Port Scanning
  • Credential-less Enumeration
    • Secure Shell
    • Simple Mail Transfer Protocol
    • File Transfer Protocol
    • Domain Name Service
    • Hypertext Transfer Protocol
    • Internet Message Access Protocol / Post Office Protocol
    • Kerberos
    • Remote Procedure Call
    • Server Message Block
    • Simple Network Management Protocol
    • Lightweight Directory Access Protocol
    • Netlogon Remote Protocol
    • Network File Share
    • Remote Desktop Protocol
    • My Structured Query Language
    • Microsoft Structured Query Language
    • Oracle Transparent Network Substrate
    • Intelligent Platform Management Interface
    • Rsync
    • R-Services
    • Remote Desktop Protocol
    • Windows Remote Management
    • Windows Management Instrumentation
  • Credentialed Enumeration
    • Secure Shell
    • Server Message Block
    • Lightweight Directory Access Protocol
    • Kerberos
    • MSSQL
    • Windows Remote Management
  • Privilege Escalation
    • Linux
    • Windows
  • Windows Active Directory
    • Abuse Weak Access Control Lists (ACLs)
    • Overpass The Hash
    • Object Scoping
    • Pass The Ticket
  • Miscellaneous
    • File Transfers
    • Shells & Payloads
    • Metasploit Framework
    • Password Mutations
  • All Notes
Powered by GitBook
On this page
  • Footprinting the Service
  • Showing Available Shares
  • Mounting NFS Shares
  • List Contents with Usernames & Group Names
  • List Contents with UIDs & GUIDs
  • Unmounting Share
  • Dangerous Settings
  1. Credential-less Enumeration

Network File Share

PreviousNetlogon Remote ProtocolNextRemote Desktop Protocol

Last updated 1 year ago

Footprinting the Service

sudo nmap --script nfs* 10.129.14.128 -sV -p111,2049

Showing Available Shares

showmount -e 10.129.14.128

Mounting NFS Shares

mkdir target-NFS
sudo mount -t nfs 10.129.14.128:/ ./target-NFS/ -o nolock
cd target-NFS
tree .

List Contents with Usernames & Group Names

ls -l mnt/nfs/

List Contents with UIDs & GUIDs

ls -n mnt/nfs/

Unmounting Share

sudo umount ./target-NFS

Dangerous Settings

Option
Description

rw

Read and write permissions.

insecure

Ports above 1024 will be used.

nohide

If another file system was mounted below an exported directory, this directory is exported by its own exports entry.

no_root_squash

All files created by root are kept with the UID/GID 0.