NFS (Network File System) exports Unix directories over the network. Its defining weakness is the traditional AUTH_SYS (sec=sys) security model, under which the server trusts whatever user and group IDs the client includes in each request: there is no authentication of the client's claimed identity, only the IDs it asserts. That makes an NFS export with default options a near-open door. The surface is enumerating the exports and their options, abusing no_root_squash to act as root on the export, spoofing arbitrary UIDs/GIDs to access any user's files, and the comparatively harder NFSv4-with-Kerberos configurations.
# discover exports and the RPC services behind NFS
showmount -e <target> # exported paths and allowed clients
rpcinfo -p <target> # mountd/nfs/portmapper ports
nmap -p111,2049 --script nfs-showmount,nfs-ls <target>
Subtopics#
- Enumeration: exports, options, and mounting.
- no_root_squash abuse: writing files as root on an export.
- UID and GID spoofing: impersonating any user under AUTH_SYS.
- NFSv4 and Kerberos: the stronger configuration and its weak points.