Skip to content
HackIndex.io

NFS Export Discovery

4 min read Created Jan 4, 2026 Last updated Jan 4, 2026

NFS export discovery identifies which directories a server shares and who is permitted to mount them. Port 111 (RPCbind/portmapper) and port 2049 (NFS) both need to respond for a working NFS setup. Confirm both are open before running export queries. An export with no client restriction is immediately mountable from any host on the network.

Pay close attention to exported path names. Shares like /home, /etc, /backup, /var, or /root signal high-value targets. Even a restricted export may be reachable from your position depending on how the client restriction is defined. Wildcard or subnet restrictions are weaker than they look.

High-value export paths to watch for:

  • /home or /root for SSH keys and user credentials

  • /etc for passwd, shadow, and configuration files

  • /backup or /var for database dumps and logs

  • /opt or /srv for application data and scripts

NFS export discovery with Nmap

Export listing:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 --script nfs-showmount $TARGET_IP

Output includes the export path, the permitted client (hostname, IP, subnet, or wildcard), and mount options. A wildcard (*) or the string "everyone" means any host can mount. A subnet like 10.0.0.0/8 may still include your attack machine. Watch for the no_root_squash option in the output: it means the remote root user maps directly to root on the server, which enables privilege escalation after mounting. That option alone changes how aggressively you pursue access.

Full NFS coverage:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 --script nfs-* $TARGET_IP

Running all nfs-* scripts adds directory listing (nfs-ls) and filesystem statistics (nfs-statfs) on top of export enumeration. The nfs-ls output shows file names, sizes, and permissions without mounting. Use this to confirm interesting content exists before committing to a mount. nfs-statfs gives disk usage, which helps distinguish active shares from empty or stub exports.

showmount Export Dump

All exports:

┌──(kali㉿kali)-[~]
└─$ showmount -e $TARGET_IP

showmount -e is the most direct way to dump the export table. The output format is straightforward: path on the left, client restriction on the right. A bare asterisk or "(everyone)" means no restriction. Empty output usually means either no exports are configured or port 111 is filtered upstream. If port 2049 is open but port 111 is blocked, rpcinfo will fail, but NFS v4 mounts may still work directly against port 2049 without going through portmapper.

General info:

┌──(kali㉿kali)-[~]
└─$ showmount $TARGET_IP

showmount without -e returns the list of currently active mounts, not the export list. This is useful to identify other hosts actively using the share. Seeing a client IP in the mount list tells you the export is live and in use, which raises the value of any data you find. A responsive server here also confirms the portmapper is reachable and the NFS daemon is running.

rpcinfo Service Probe

Bound RPC programs:

┌──(kali㉿kali)-[~]
└─$ rpcinfo -p $TARGET_IP

rpcinfo -p queries the portmapper for all registered RPC programs. The output lists program number, version, protocol (tcp/udp), port, and service name. Scan the full list before filtering, since unexpected RPC services can indicate additional attack surface beyond NFS.

Filter NFS-related:

┌──(kali㉿kali)-[~]
└─$ rpcinfo -p $TARGET_IP | grep -E "nfs|mountd|nlockmgr|status"

Program 100003 is the NFS daemon and 100005 is mountd, the service that authorises and tracks mounts. Both must appear for normal NFS operation. If only mountd appears without 100003, the NFS daemon may be down or listening on a non-standard port. Pay attention to the version numbers: NFS v2 and v3 support both TCP and UDP, while NFS v4 is TCP-only and has stricter authentication requirements. Seeing only v4 makes anonymous mounting less likely but still worth testing. Version numbers also tell you which mount syntax to use when forcing a specific protocol version.

TCP/UDP check:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 -sT $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 -sU $TARGET_IP

Port 111 is required for v2 and v3 mounts. Port 2049 is the NFS data port. NFS v4 uses only TCP on port 2049 and skips portmapper entirely. If UDP 2049 is open alongside TCP, NFS v3 with anonymous access is likely in play. A confirmed export combined with open ports is enough to move directly to mounting and content inspection.

References