111, 2049 - NFS

PRIMARY CATEGORY → PROTOCOLS AND SERVICES

Theory

NFS → Net File System

Ports

• 111 → RCP Portmapper

This port is associated with the Portmapper Service, which maps dynamic ports to certain RPC Endpoints such as lockd or mountd

Therefore, when an NFS client mounts a remote shared resource on a local directory, depending on the mount options, It may have to communicate with the Port Mapper to find out on which port a certain RCP Endpoint is listening

The situation above occurs mainly in NFSv2 and NFSv3

• 2049 → NFS Principal Port

It is the primary port for data transfer and certain operations related to the remote file systems

Important

In NFSv4, all services related to the RCP Endpoints such as file lock are consolidated on port 2049

This, therefore, removes the need to interact with port 111

---

Enumeration

List NFS Server’s Exports (Shared Resources)

showmount --exports <TARGET> # Long Format
showmount -e <TARGET> # Short Format

Mounting an NFS Share

Create a local directory where the remote Directory/FileSystem is to be mounted

mkdir <LOCAL_DIR>

NFSv2

mount --types nfs --options vers=2,nolock <TARGET>:<REMOTE_RESOURCE_PATH> <LOCAL_DIR> # Long Format
mount -t nfs -o vers=2,nolock <TARGET>:<REMOTE_RESOURCE_PATH> <LOCAL_DIR> # Short Format

NFSv3

mount --types nfs --options vers=3,nolock <TARGET>:<REMOTE_RESOURCE_PATH> <LOCAL_DIR> # Long Format
mount -t nfs -o vers=3,nolock <TARGET>:<REMOTE_RESOURCE_PATH> <LOCAL_DIR> # Short Format

NFSv4

mount --types nfs --options vers=4,nolock <TARGET>:<REMOTE_RESOURCE_PATH> <LOCAL_DIR> # Long Format
mount -t nfs -o vers=4,nolock <TARGET>:<REMOTE_RESOURCE_PATH> <LOCAL_DIR> # Short Format

---

NFS no_root_squash Privesc

See here