| Server IP : 80.241.246.6 / Your IP : 216.73.216.129 Web Server : Apache/2.4.25 (Debian) System : Linux kharagauli 4.9.0-19-amd64 #1 SMP Debian 4.9.320-2 (2022-06-30) x86_64 User : www-data ( 33) PHP Version : 7.0.33-0+deb9u12 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority, MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /usr/share/doc/netcat-traditional/examples/data/ |
Upload File : |
# portmap request for mountd [or whatever; see where prog=MOUNT] # send to UDP 111 and hope it's not a logging portmapper! # split into longwords, since rpc apparently only deals with them 001 # 0x01 # . # XID: 4 trash bytes 002 # 0x02 # . 003 # 0x03 # . 004 # 0x04 # . 000 # 0x00 # . # MSG: int 0=call, 1=reply 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . # pmap call body: rpc version=2 000 # 0x00 # . 000 # 0x00 # . 002 # 0x02 # . 000 # 0x00 # . # pmap call body: prog=PMAP, 100000 001 # 0x01 # . 134 # 0x86 # . 160 # 0xa0 # . 000 # 0x00 # . # pmap call body: progversion=2 000 # 0x00 # . 000 # 0x00 # . 002 # 0x02 # . 000 # 0x00 # . # pmap call body: proc=GETPORT, 3 000 # 0x00 # . 000 # 0x00 # . 003 # 0x03 # . # with AUTH_NONE, there are 4 zero integers [16 bytes] here 000 # 0x00 # . # auth junk: cb_cred: auth_unix = 1; NONE = 0 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . # auth junk 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . # auth junk 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . # auth junk 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . # prog=MOUNT, 100005 001 # 0x01 # . 134 # 0x86 # . 165 # 0xa5 # . 000 # 0x00 # . # progversion=1 000 # 0x00 # . 000 # 0x00 # . 001 # 0x01 # . 000 # 0x00 # . # protocol=udp, 17 000 # 0x00 # . 000 # 0x00 # . 017 # 0x11 # . 000 # 0x00 # . # proc num = junk 000 # 0x00 # . 000 # 0x00 # . 000 # 0x00 # . # The reply you get back contains your XID, int 1 if "accepted", and # mountd's port number at the end or 0 if not registered.