> For the complete documentation index, see [llms.txt](https://oscp.nstsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.nstsec.com/services-exploitation/111-nfs-rpc.md).

# 111 - NFS/RPC

scanning for

```bash
nmap -v -p 111 10.11.1.1-254
```

search for nmap NSE scripts

<pre class="language-bash"><code class="lang-bash">ls -1 /usr/share/nmap/scripts/nfs*
<strong>    /usr/share/nmap/scripts/nfs-ls.nse
</strong>    /usr/share/nmap/scripts/nfs-showmount.nse
    /usr/share/nmap/scripts/nfs-statfs.nse
</code></pre>

nmap NSE script

```
nmap -sV -p 111 --script=rpcinfo 10.11.1.1-254
nmap -p 111 --script nfs* 10.11.1.72
```

mount a share

```bash
mkdir <local_folder>
sudo mount -o nolock 10.11.1.72:<remote_folder> <local_folder>
cd <local_folder> && ls
```

mount a share downgrading NFS version

```bash
sudo mount -t nfs -o vers=3 <ip>:<remote_folder> <local_folder> -o nolock
```