> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/nfs.md).

# NFS

* <https://resources.infosecinstitute.com/exploiting-nfs-share/>
* <https://blog.christophetd.fr/write-up-vulnix/>
* <https://book.hacktricks.xyz/linux-unix/privilege-escalation/nfs-no_root_squash-misconfiguration-pe>

## Nmap

Discover rpcbind:

```
$ sudo nmap -sV --script rpcinfo 10.10.13.37 -p111
```

Run Nmap scripts:

```
$ sudo nmap -sV --script 'nfs*' 10.10.13.37 -p2049
```

## Mount

```
$ showmount -e 10.10.13.37
$ sudo mount -v -t nfs -o vers=3 -o nolock -o user=snovvcrash,pass='Passw0rd!' 10.10.13.37:/home /mnt/nfs
```