NFS enumeration

nmap

Discovery

Use nmap to scan port 111 (rpcbind). If NFS is registered with rpcbind then it should show in rpcinfo output as listening on TCP port 2049. The rpcinfo binary can be used on its own as well.

sudo nmap -vvv -p 111 --script=default,rpcinfo -sV $IP

Finding mount

Finding the actual directory name of the share is needed to mount a NFS locally.

nmap -p 111 --script=nfs-showmount $IP

rpcinfo

Use rpcinfo to show the services registered with rpc:

rpcinfo -p $IP

Accessing NFS

If an NFS share is present, use nmap for Finding mount. Then use that to mount the NFS share locally.

sudo mount -o nolock $IP:$REMOTE_DIR $LOCAL_DIR

If the current user does not have permissions, add a new user that matches the UID of the file owner and access with that user instead.