NFS
Pentesting NFS - TCP/UDP Port 2049
Last updated
Was this helpful?
Pentesting NFS - TCP/UDP Port 2049
Last updated
Was this helpful?
NFS is a distributed file system protocol that allows a user on a client computer to access files over a computer network much like local storage is accessed. Default ports are and 2049.
The NFS protocol has no mechanism for authentication or authorization. The authorization is taken from the available information of the file system where the server is responsible for translating the user information supplied by the client to that of the file system and converting the corresponding authorization information as correctly as possible into the syntax required by UNIX.
Following nmap scripts can be used to enumerate a NFS server
To know which folder has the server available to mount you can use following commands and modules
If we find a folder available, we can mount it to local folder.
Create a new folder under /mnt
Now mount the folder
To confirm or unmount shares, you can use following commands
The most common authentication is via UNIX UID/GID and group memberships, which is why this syntax is most likely to be applied to the NFS protocol. One problem is that the client and server do not necessarily have to have the same mappings of UID/GID to users and groups. No further checks can be made on the part of the server. This is why NFS should only be used with this authentication method in trusted networks.
If you mount a folder which contains files or folders only accesible by some user (by UID). You can create locally a user with that UID and using that user you will be able to access the file/folder.
The NFS server configuration can be found in its local files
Some settings can be dangerous and even allow local privileges escalation:
rw
Read and write permissions.
insecure
Ports above 1024 will be used. in secure mode, forces the client to communicate using a port below 1024, hence proving they are root
nohide
If another file system was mounted below an exported directory, this directory is exported by its own exports entry.
no_root_squash
no_all_squash
We can abuse the no_root_squash and no_all_squash NFS configurations, as explained on this page.
All files created by root are kept with the UID/GID 0. See.
This is similar to no_root_squash option but applies to non-root users. See .
