> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/services/2049-nfs.md).

# (2049) NFS

<details>

<summary>Nmap scanning</summary>

```bash
nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 {IP}
```

</details>

<details>

<summary>To find which folder is able to be mounted</summary>

```bash
showmount -e <IP>
```

</details>

<details>

<summary>Mount folder</summary>

```bash
mount -t nfs [-o vers=2] <ip>:<remote_folder> <local_folder> -o nolock
```

Should use version 2 because it doesn't have any authentication/authorization.

</details>

<details>

<summary>Exploit: NFS Imitation</summary>

Using the command `ls -ld` I was able to view the permissions for the shares.

<img src="/files/C9wWPv12CsJ6DfqhNvBn" alt="" data-size="original">

`mapped_www` is owned by the UID 2017, and belongs to the group with the ID of www-data.

Creating a dummy user with the UID as 2017 and GID as 2017,

<img src="/files/fUrvRQoEXQM2mEJZ1TfN" alt="" data-size="original">

I was able to view the files present in that directory.

<img src="/files/wKPbIkPfNLRYSKP3t6FR" alt="" data-size="original">

</details>