Hacking Notes
  • What is this?
  • Reconnaissance 🗣
    • Information Gathering 🗣
  • Enumeration 🎯
    • Host Discovery 🛎
    • DNS Enumeration
    • OS Discovery 🖥
    • Port Scanning 📟
    • WAF Evasion
  • Web 📱
    • Unrestricted File Upload
    • Templates Injections ✖️
    • File Inclusion
    • Login Panes
    • SQL Injection
    • NoSQL Injection
    • OAuth 2.0 Bypass
  • Privilege Escalation
    • Linux Privesc
    • Windows Privesc
    • Run Commands AS
  • Post Explotation 💀
    • Port Forwarding and Tunneling
    • Transfering Files 📤
    • Reverse Shell 🔙
    • Crypto 101 👁
    • AV Evasion
    • Bypass UAC
    • Get Credentials
  • Services
    • PORT 21/tcp - FTP
    • PORT 25/tcp - SMTP
    • PORT 53/tcp/udp - DNS
    • Port 80,443/tcp - HTTP
    • Port 111/tcp - RPCBind
    • PORT 143,993/tcp - IMAP
    • PORT 139,445/tcp - SMB
    • PORT 161/udp - SNMP
    • PORT 1100/tcp - Java RMI
    • PORT 1433/tcp - Microsoft SQL Server
    • PORT 2049/tcp - NFS
    • PORT 3306/tcp MySQL
    • PORT 3389/tcp RDP
    • PyPI Server
  • Software
    • Tomcat
    • Jenkins
    • Drupal
    • Wordpress
  • Client-Side Attacks
    • Evil PDF
    • Microsoft Office Macros
  • Other
    • Hacking WiFI
      • WPA/WPA2 PSK
      • WPA/WPA2 PEAP (Enterprise)
      • WEP
    • Hacking with Powershell
    • Hacking AWS
  • Exploiting
    • Buffer Overflow
  • Active Directory
    • 🖥️AD Attacks
Powered by GitBook
On this page
  • Enumeration
  • NFS
  • References:

Was this helpful?

  1. Services

Port 111/tcp - RPCBind

Provides information between Unix based systems. Port is often probed, it can be used to fingerprint the Nix OS, and to obtain information about available services. Port used with NFS, NIS or others..

Enumeration

We can enumerate RPCBind service with rpcinfo or nmap:

rpcinfo ip-addr
nmap -sSUC -p 111 ip-addr

Example output of rpcinfo:

program version netid     address                service    owner
    100000    4    tcp6      ::.0.111               portmapper superuser
    100000    3    tcp6      ::.0.111               portmapper superuser
    100000    4    udp6      ::.0.111               portmapper superuser
    100000    3    udp6      ::.0.111               portmapper superuser
    100000    4    tcp       0.0.0.0.0.111          portmapper superuser
    100000    3    tcp       0.0.0.0.0.111          portmapper superuser
    100000    2    udp       0.0.0.0.0.111          portmapper superuser
    100000    4    local     /run/rpcbind.sock      portmapper superuser
    100000    3    local     /run/rpcbind.sock      portmapper superuser
    100005    1    udp       0.0.0.0.128.213        mountd     superuser
    100005    1    tcp       0.0.0.0.208.235        mountd     superuser
    100005    1    udp6      ::.163.28              mountd     superuser
    100005    1    tcp6      ::.183.211             mountd     superuser
    100005    2    udp       0.0.0.0.190.193        mountd     superuser
    100005    2    tcp       0.0.0.0.188.127        mountd     superuser
    100005    2    udp6      ::.233.215             mountd     superuser
    100005    2    tcp6      ::.165.45              mountd     superuser
    100005    3    udp       0.0.0.0.130.78         mountd     superuser
    100005    3    tcp       0.0.0.0.148.209        mountd     superuser
    100005    3    udp6      ::.150.143             mountd     superuser
    100005    3    tcp6      ::.217.45              mountd     superuser
    100003    2    tcp       0.0.0.0.8.1            nfs        superuser
    100003    3    tcp       0.0.0.0.8.1            nfs        superuser
    100003    4    tcp       0.0.0.0.8.1            nfs        superuser
    100227    2    tcp       0.0.0.0.8.1            -          superuser
    100227    3    tcp       0.0.0.0.8.1            -          superuser
    100003    2    udp       0.0.0.0.8.1            nfs        superuser
    100003    3    udp       0.0.0.0.8.1            nfs        superuser
    100003    4    udp       0.0.0.0.8.1            nfs        superuser
    100227    2    udp       0.0.0.0.8.1            -          superuser
    100227    3    udp       0.0.0.0.8.1            -          superuser
    100003    2    tcp6      ::.8.1                 nfs        superuser
    100003    3    tcp6      ::.8.1                 nfs        superuser
    100003    4    tcp6      ::.8.1                 nfs        superuser
    100227    2    tcp6      ::.8.1                 -          superuser
    100227    3    tcp6      ::.8.1                 -          superuser
    100003    2    udp6      ::.8.1                 nfs        superuser
    100003    3    udp6      ::.8.1                 nfs        superuser
    100003    4    udp6      ::.8.1                 nfs        superuser
    100227    2    udp6      ::.8.1                 -          superuser
    100227    3    udp6      ::.8.1                 -          superuser
    100021    1    udp       0.0.0.0.167.136        nlockmgr   superuser
    100021    4    tcp       0.0.0.0.174.121        nlockmgr   superuser
    100021    1    udp6      ::.164.129             nlockmgr   superuser
    100021    1    tcp6      ::.130.83              nlockmgr   superuser

NFS

If you find the service NFS then probably you will be able to list and download(and maybe upload) files:

nmap -p 2049 -sV --script nfs-\* ip-addr
showmount -e ip-addr

After finding the nfs folder we can mount these shares in our filesystem:

sudo mount -o nolock -t nfs [-o vers=2] <ip-addr>:<remote_folder> <local_folder>

More info in:

References:

PreviousPort 80,443/tcp - HTTPNextPORT 143,993/tcp - IMAP

Last updated 3 years ago

Was this helpful?

PORT 2049/tcp - NFS
https://docs.oracle.com/cd/E56339_01/html/E53865/gntib.html
https://book.hacktricks.xyz/pentesting/nfs-service-pentesting
https://book.hacktricks.xyz/pentesting/pentesting-rpcbind