NFS

NFS exports Unix filesystems over the network, and with the traditional AUTH_SYS security it trusts the client-supplied user and group IDs entirely. The offensive surface is enumerating exports and their options, abusing no_root_squash to write files as root, spoofing UIDs and GIDs to read and write any user's files, and the weaker points of NFSv4 with Kerberos.

1 நிமிட வாசிப்பு5 அக்., 2026 அன்று புதுப்பிக்கப்பட்டதுflorianamette1 பங்களிப்பாளர்
உங்கள் உதவியாளரிடம் கேளுங்கள் (MCP)GitHub இல் திருத்து

NFS (Network File System) exports Unix directories over the network. Its defining weakness is the traditional AUTH_SYS (sec=sys) security model, under which the server trusts whatever user and group IDs the client includes in each request: there is no authentication of the client's claimed identity, only the IDs it asserts. That makes an NFS export with default options a near-open door. The surface is enumerating the exports and their options, abusing no_root_squash to act as root on the export, spoofing arbitrary UIDs/GIDs to access any user's files, and the comparatively harder NFSv4-with-Kerberos configurations.

bash
# discover exports and the RPC services behind NFS
showmount -e <target>                         # exported paths and allowed clients
rpcinfo -p <target>                           # mountd/nfs/portmapper ports
nmap -p111,2049 --script nfs-showmount,nfs-ls <target>

Subtopics#

References#

முந்தையதுGuest accessஅடுத்தது Enumeration