NFS

NFS

NFS exports Unix filesystems over the network, and with the traditional AUTH_SYS security it trusts the client-supplied user and group IDs entirely. The offensive surface is enumerating exports and their options, abusing no_root_squash to write files as root, spoofing UIDs and GIDs to read and write any user's files, and the weaker points of NFSv4 with Kerberos.

1 min di letturaaggiornato il 5 ott 2026

1 contributore

NFS (Network File System) exports Unix directories over the network. Its defining weakness is the traditional AUTH_SYS (sec=sys) security model, under which the server trusts whatever user and group IDs the client includes in each request: there is no authentication of the client's claimed identity, only the IDs it asserts. That makes an NFS export with default options a near-open door. The surface is enumerating the exports and their options, abusing no_root_squash to act as root on the export, spoofing arbitrary UIDs/GIDs to access any user's files, and the comparatively harder NFSv4-with-Kerberos configurations.

bash

# discover exports and the RPC services behind NFS
showmount -e <target>                         # exported paths and allowed clients
rpcinfo -p <target>                           # mountd/nfs/portmapper ports
nmap -p111,2049 --script nfs-showmount,nfs-ls <target>

Subtopics#

Enumeration: exports, options, and mounting.
no_root_squash abuse: writing files as root on an export.
UID and GID spoofing: impersonating any user under AUTH_SYS.
NFSv4 and Kerberos: the stronger configuration and its weak points.

Subtopics#

References#