> For the complete documentation index, see [llms.txt](https://cheats.philkeeble.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cheats.philkeeble.com/linux/untitled.md).

# Enumeration

## Spawn TTY

```
python -c 'import pty; pty.spawn("/bin/sh")'
```

{% embed url="<https://netsec.ws/?p=337>" %}

## NFS

```
# List exposed NFS Shares
nmap -p 111 --script=nfs-ls <host>

# Create dir to link to
mkdir /mnt/remote_nfs

# Mount exposed share and link to local dir 
mount -t nfs <IP>:</exposed/dir> /mnt/remote_nfs -o nolock

# Browse
cd /mnt/remote_nfs
```