HackTricks Press
Search K

Appearance

2049 - Pentesting NFS Service ​

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Basic Information ​

NFS is a system designed for client/server that enables users to seamlessly access files over a network as though these files were located within a local directory.

A notable aspect of this protocol is its lack of built-in authentication or authorization mechanisms. Instead, authorization relies on file system information, with the server tasked with accurately translating client-provided user information into the file system's required authorization format, primarily following UNIX syntax.

Authentication commonly relies on UNIX UID/GID identifiers and group memberships. However, a challenge arises due to the potential mismatch in UID/GID mappings between clients and servers, leaving no room for additional verification by the server. Consequently, the protocol is best suited for use within trusted networks, given its reliance on this method of authentication.

Default port: 2049/TCP/UDP (except version 4, it just needs TCP or UDP). 

2049/tcp open  nfs     2-3 (RPC #100003

Versions ​

  • NFSv2: This version is recognized for its broad compatibility with various systems, marking its significance with initial operations predominantly over UDP. Being the oldest in the series, it laid the groundwork for future developments.

  • NFSv3: Introduced with an array of enhancements, NFSv3 expanded on its predecessor by supporting variable file sizes and offering improved error reporting mechanisms. Despite its advancements, it faced limitations in full backward compatibility with NFSv2 clients.

  • NFSv4: A landmark version in the NFS series, NFSv4 brought forth a suite of features designed to modernize file sharing across networks. Notable improvements include the integration of Kerberos for high security, the capability to traverse firewalls and operate over the Internet without the need for portmappers, support for Access Control Lists (ACLs), and the introduction of state-based operations. Its performance enhancements and the adoption of a stateful protocol distinguish NFSv4 as a pivotal advancement in network file sharing technologies.

Each version of NFS has been developed with the intent to address the evolving needs of network environments, progressively enhancing security, compatibility, and performance.

Enumeration ​

Useful nmap scripts ​

bash
nfs-ls #List NFS exports and check permissions
nfs-showmount #Like showmount -e
nfs-statfs #Disk statistics and info from NFS share

Useful metasploit modules ​

bash
scanner/nfs/nfsmount #Scan NFS mounts and list permissions

Mounting ​

To know which folder has the server available to mount you an ask it using:

bash
showmount -e <IP>

Then mount it using:

bash
mount -t nfs [-o vers=2] <ip>:<remote_folder> <local_folder> -o nolock

You should specify to use version 2 because it doesn't have any authentication or authorization.

Example:

bash
mkdir /mnt/new_back
mount -t nfs [-o vers=2] 10.12.0.150:/backup /mnt/new_back -o nolock

Permissions ​

If you mount a folder which contains files or folders only accesible by some user (by UID). You can create locally a user with that UID and using that user you will be able to access the file/folder.

NSFShell ​

To easily list, mount and change UID and GID to have access to files you can use nfsshell.

Nice NFSShell tutorial.

Config files ​

/etc/exports
/etc/lib/nfs/etab

Dangerous settings ​

  • Read and Write Permissions (rw): This setting allows both reading from and writing to the file system. It's essential to consider the implications of granting such broad access.

  • Use of Insecure Ports (insecure): When enabled, this allows the system to utilize ports above 1024. The security of ports above this range can be less stringent, increasing risk.

  • Visibility of Nested File Systems (nohide): This configuration makes directories visible even if another file system is mounted below an exported directory. Each directory requires its own export entry for proper management.

  • Root Files Ownership (no_root_squash): With this setting, files created by the root user maintain their original UID/GID of 0, disregarding the principle of least privilege and potentially granting excessive permissions.

  • Non-Squashing of All Users (no_all_squash): This option ensures that user identities are preserved across the system, which could lead to permission and access control issues if not correctly handled.

Privilege Escalation using NFS misconfigurations ​

NFS no_root_squash and no_all_squash privilege escalation

HackTricks Automatic Commands ​

Protocol_Name: NFS    #Protocol Abbreviation if there is one.
Port_Number:  2049     #Comma separated if there is more than one.
Protocol_Description: Network File System         #Protocol Abbreviation Spelled out

Entry_1:
  Name: Notes
  Description: Notes for NFS
  Note: |
    NFS is a system designed for client/server that enables users to seamlessly access files over a network as though these files were located within a local directory. 

    #apt install nfs-common
    showmount 10.10.10.180      ~or~showmount -e 10.10.10.180
    should show you available shares (example /home)

    mount -t nfs -o ver=2 10.10.10.180:/home /mnt/
    cd /mnt
    nano into /etc/passwd and change the uid (probably 1000 or 1001) to match the owner of the files if you are not able to get in

    https://book.hacktricks.xyz/pentesting/nfs-service-pentesting

Entry_2:
  Name: Nmap
  Description: Nmap with NFS Scripts
  Command: nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 {IP}
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!