HackTricks
Search…
🤩
Generic Methodologies & Resources
🐧
Linux Hardening
🍏
MacOS Hardening
🪟
Windows Hardening
📱
Mobile Pentesting
👽
Network Services Pentesting
🕸
Pentesting Web
⛈
Cloud Security
😎
Hardware/Physical Access
🦅
Reversing & Exploiting
🔮
Crypto & Stego
🧐
External Platforms Reviews/Writeups
✍
TODO
2049 - Pentesting NFS Service
Support HackTricks and get benefits!
Basic Information
It is a client/server system that allows users to access files across a network and treat them as if they resided in a local file directory.
Default port: 2049
1
2049/tcp open nfs 2-3 (RPC #100003
Copied!
Enumeration
Useful nmap scripts
1
nfs-ls #List NFS exports and check permissions
2
nfs-showmount #Like showmount -e
3
nfs-statfs #Disk statistics and info from NFS share
Copied!
Useful metasploit modules
1
scanner/nfs/nfsmount #Scan NFS mounts and list permissions
Copied!
Mounting
To know which folder has the server available to mount you an ask it using:
1
showmount -e <IP>
Copied!
Then mount it using:
1
mount -t nfs [-o vers=2] <ip>:<remote_folder> <local_folder> -o nolock
Copied!
You should specify to use version 2 because it doesn't have any authentication or authorization.
Example:
1
mkdir /mnt/new_back
2
mount -t nfs [-o vers=2] 10.12.0.150:/backup /mnt/new_back -o nolock
Copied!
Permissions
If you mount a folder which contains files or folders only accesible by some user (by UID). You can create locally a user with that UID and using that user you will be able to access the file/folder.
NSFShell
Config files
1
/etc/exports
2
/etc/lib/nfs/etab
Copied!
Privilege Escalation using NFS misconfigurations
HackTricks Automatic Commands
1
Protocol_Name: NFS #Protocol Abbreviation if there is one.
2
Port_Number: 2049 #Comma separated if there is more than one.
3
Protocol_Description: Network File System #Protocol Abbreviation Spelled out
4
5
Entry_1:
6
Name: Notes
7
Description: Notes for NFS
8
Note: |
9
It is a client/server system that allows users to access files across a network and treat them as if they resided in a local file directory.
10
11
#apt install nfs-common
12
showmount 10.10.10.180 ~or~showmount -e 10.10.10.180
13
should show you available shares (example /home)
14
15
mount -t nfs -o ver=2 10.10.10.180:/home /mnt/
16
cd /mnt
17
nano into /etc/passwd and change the uid (probably 1000 or 1001) to match the owner of the files if you are not able to get in
18
19
https://book.hacktricks.xyz/pentesting/nfs-service-pentesting
20
21
Entry_2:
22
Name: Nmap
23
Description: Nmap with NFS Scripts
24
Command: nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 {IP}
Copied!
Support HackTricks and get benefits!