111 - NFS/RPC

rpcinfo -p TARGET
showmount -e TARGET
sudo mkdir -p /mnt/oscp-nfs
sudo mount -t nfs -o ro,nosuid,nodev TARGET:/EXPORT /mnt/oscp-nfs
ls -lan /mnt/oscp-nfs

Replace /EXPORT with a discovered export. Inspect numeric owners, readable application files, backups and keys; use the credential workflow for encrypted material. A mount is not proof of write access or no_root_squash. UID mapping, server export policy and filesystem permissions still apply. Unmount after inspection:

sudo umount /mnt/oscp-nfs

NFSv4 is reachable but showmount returns no exports

An NFSv4-only server need not expose the MNT service used by showmount. When TCP 2049/application evidence identifies NFSv4, try the exported namespace root:

sudo mount -t nfs -o vers=4,ro,nosuid,nodev TARGET:/ /mnt/oscp-nfs
ls -lan /mnt/oscp-nfs

An access denial still needs the expected export path and permitted client/authentication checked. It does not justify guessing that the export is absent. showmount limitations.

Additional scan and legacy mount variants

scanning for

nmap -v -p 111 10.11.1.1-254

search for nmap NSE scripts

ls -1 /usr/share/nmap/scripts/nfs*
    /usr/share/nmap/scripts/nfs-ls.nse
    /usr/share/nmap/scripts/nfs-showmount.nse
    /usr/share/nmap/scripts/nfs-statfs.nse

nmap NSE script

nmap -sV -p 111 --script=rpcinfo 10.11.1.1-254
nmap -p 111 --script nfs* 10.11.1.72

mount a share

mkdir <local_folder>
sudo mount -o nolock 10.11.1.72:<remote_folder> <local_folder>
cd <local_folder> && ls

mount a share downgrading NFS version

sudo mount -t nfs -o vers=3 <ip>:<remote_folder> <local_folder> -o nolock