(Message inbox:4042) Date: Tue, 19 May 1998 12:22:57 MDT To: BUGTRAQ@NETSPACE.ORG From: Oliver Friedrichs Subject: Re: NFS shell Return-Path: leendert@cs.vu.nl Delivery-Date: Tue May 19 14:43:22 1998 Return-Path: Resent-From: leendert@cs.vu.nl Resent-Message-Id: Approved-By: aleph1@NATIONWIDE.NET X-Sender: oliver@silence.secnet.com MIME-Version: 1.0 Reply-To: Oliver Friedrichs Sender: Bugtraq List X-To: Leendert van Doorn In-Reply-To: Resent-To: leendert@watson.ibm.com Resent-Date: Tue, 19 May 98 20:43 +0200 Content-Length: 952 > The sources are in: > > ftp://ftp.cs.vu.nl/pub/leendert/nfsshell.tar.gz > > Suggestions for improvements are welcome. Some interesting features that people will probably want to add to this: - ability to query rpcbind/portmap on port 32771. rpcbind on (unpatched) solaris listened on a port equal to, or above 32771. This allows you to bypass any filters that may be blocking standard portmap/rpcbind on port 111. - ability to perform NFS over port 4045. Solaris nlockmgr service will accept any NFS packets and always listens on port 4045, probably because it's a direct path into the kernel like NFS is. This allows you to bypass any filters that may be blocking NFS traffic on port 2049. Just 2 of a number of undocumented services that we found in Solaris... - Oliver - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Network Associates, Inc. 2805 Bowers Ave, Santa Clara, CA, 95051