64 lines
921 B
D
64 lines
921 B
D
|
# UDP mountd call. Use as input to find mount daemons and avoid portmap.
|
||
|
|
# Useful proc numbers are 2, 5, and 6.
|
||
|
|
# UDP-scan around between 600-800 to find most mount daemons.
|
||
|
|
# Using this with "2", plugged into "nc -u -v -w 2 victim X-Y" will
|
||
|
|
# directly scan *and* dump the current exports when mountd is hit.
|
||
|
|
# combine stdout *and* stderr thru "strings" or something to clean it up
|
||
|
|
|
||
|
|
000 # XID: 4 trash bytes
|
||
|
|
001
|
||
|
|
002
|
||
|
|
003
|
||
|
|
|
||
|
|
000 # CALL: 0
|
||
|
|
000
|
||
|
|
000
|
||
|
|
000
|
||
|
|
|
||
|
|
000 # RPC version: 2
|
||
|
|
000
|
||
|
|
000
|
||
|
|
002
|
||
|
|
|
||
|
|
000 # mount: 100005
|
||
|
|
001
|
||
|
|
0x86
|
||
|
|
0xa5
|
||
|
|
|
||
|
|
000 # mount version: 1
|
||
|
|
000
|
||
|
|
000
|
||
|
|
001
|
||
|
|
|
||
|
|
000 # procedure number -- put what you need here:
|
||
|
|
000 # 2 = dump [showmount -e]
|
||
|
|
000 # 5 = exportlist [showmount -a]
|
||
|
|
xxx # "sed s/xxx/$1/ | data -g | nc ..." or some such...
|
||
|
|
|
||
|
|
000 # port: junk
|
||
|
|
000
|
||
|
|
000
|
||
|
|
000
|
||
|
|
|
||
|
|
000 # auth trash
|
||
|
|
000
|
||
|
|
000
|
||
|
|
000
|
||
|
|
|
||
|
|
000 # auth trash
|
||
|
|
000
|
||
|
|
000
|
||
|
|
000
|
||
|
|
|
||
|
|
000 # auth trash
|
||
|
|
000
|
||
|
|
000
|
||
|
|
000
|
||
|
|
|
||
|
|
000 # extra auth trash? probably not needed
|
||
|
|
000
|
||
|
|
000
|
||
|
|
000
|
||
|
|
|
||
|
|
# that's it!
|