Skip to content
HackIndex logo

HackIndex

NFS Export Discovery

1 min read Jan 4, 2026

Exposed exports reveal mountable paths and access lists. Positive hits confirm anonymous-readable shares for immediate mounting.

Nmap NFS Scripts

Export listing:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 --script nfs-showmount $TARGET_IP

Shows export paths, permitted hosts, and options. Wildcard (*) or everyone indicates open access.

Full NFS coverage:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 --script nfs-* $TARGET_IP

Combines showmount, ls, statfs.

showmount Export Dump

All exports:

┌──(kali㉿kali)-[~]
└─$ showmount -e $TARGET_IP

Lists paths and client restrictions. No output means no exports or filtered.

General info:

┌──(kali㉿kali)-[~]
└─$ showmount $TARGET_IP

Server details if responsive.

rpcinfo Service Probe

Bound RPC programs:

┌──(kali㉿kali)-[~]
└─$ rpcinfo -p $TARGET_IP

Filter NFS-related:

┌──(kali㉿kali)-[~]
└─$ rpcinfo -p $TARGET_IP | grep -E "nfs|mountd|nlockmgr|status"

Presence of nfs (100003) and mountd (100005) confirms active server. Version numbers guide protocol forcing.

TCP/UDP check:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 -sT $TARGET_IP
nmap -p 111,2049 -sU $TARGET_IP

Open ports validate exposure.

References