Enumeration

Spawn TTY

python -c 'import pty; pty.spawn("/bin/sh")'

https://netsec.ws/?p=337netsec.ws

NFS

# List exposed NFS Shares
nmap -p 111 --script=nfs-ls <host>

# Create dir to link to
mkdir /mnt/remote_nfs

# Mount exposed share and link to local dir 
mount -t nfs <IP>:</exposed/dir> /mnt/remote_nfs -o nolock

# Browse
cd /mnt/remote_nfs