OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 2nd quarter (Apr-Jun) 1998: Re: NFS shell

Re: NFS shell

Oliver Friedrichs (oliverSECURENETWORKS.COM)
Tue, 19 May 1998 12:22:57 -0600

> The sources are in:
>
>         ftp://ftp.cs.vu.nl/pub/leendert/nfsshell.tar.gz
>
> Suggestions for improvements are welcome.

Some interesting features that people will probably want to add to this:

- ability to query rpcbind/portmap on port 32771.  rpcbind on (unpatched)
  solaris listened on a port equal to, or above 32771.  This allows you to
  bypass any filters that may be blocking standard portmap/rpcbind on port
  111.

- ability to perform NFS over port 4045.  Solaris nlockmgr service will
  accept any NFS packets and always listens on port 4045, probably because
  it's a direct path into the kernel like NFS is.  This allows you to
  bypass any filters that may be blocking NFS traffic on port 2049.

Just 2 of a number of undocumented services that we found in Solaris...

- Oliver

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Network Associates, Inc. 2805 Bowers Ave, Santa Clara, CA, 95051