hacktricks/pentesting/nfs-service-pentesting.md

102 lines
2.8 KiB
Markdown
Raw Normal View History

# 2049 - Pentesting NFS Service
## **Basic Information**
It is a client/server system that allows users to access files across a network and treat them as if they resided in a local file directory.
**Default port**: 2049
```text
2049/tcp open nfs 2-3 (RPC #100003
```
## Enumeration
### Useful nmap scripts
```bash
nfs-ls #List NFS exports and check permissions
nfs-showmount #Like showmount -e
nfs-statfs #Disk statistics and info from NFS share
```
### Useful metasploit modules
```bash
scanner/nfs/nfsmount #Scan NFS mounts and list permissions
```
### Mounting
To know **which folder** has the server **available** to mount you an ask it using:
```bash
showmount -e <IP>
```
Then mount it using:
```bash
mount -t nfs [-o vers=2] <ip>:<remote_folder> <local_folder> -o nolock
```
You should specify to **use version 2** because it doesn't have **any** **authentication** or **authorization**.
**Example:**
```bash
mkdir /mnt/new_back
mount -t nfs [-o vers=2] 10.12.0.150:/backup /mnt/new_back -o nolock
```
## Permissions
If you mount a folder which contains **files or folders only accesible by some user** \(by **UID**\). You can **create** **locally** a user with that **UID** and using that **user** you will be able to **access** the file/folder.
## NSFShell
To easily list, mount and change UID and GID to have access to files you can use [nfsshell](https://github.com/NetDirect/nfsshell).
[Nice NFSShell tutorial.](https://www.pentestpartners.com/security-blog/using-nfsshell-to-compromise-older-environments/)
## Config files
```text
/etc/exports
/etc/lib/nfs/etab
```
## Privilege Escalation using NFS misconfigurations
[NFS no\_root\_squash and no\_all\_squash privilege escalation](../linux-unix/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.md)
2021-08-12 12:55:42 +00:00
## HackTricks Automatic Commands
```text
2021-08-12 12:55:42 +00:00
Protocol_Name: NFS #Protocol Abbreviation if there is one.
Port_Number: 2049 #Comma separated if there is more than one.
Protocol_Description: Network File System #Protocol Abbreviation Spelled out
2021-08-15 17:39:13 +00:00
Entry_1:
Name: Notes
Description: Notes for NFS
Note: |
It is a client/server system that allows users to access files across a network and treat them as if they resided in a local file directory.
#apt install nfs-common
showmount 10.10.10.180 ~or~showmount -e 10.10.10.180
2021-08-12 12:55:42 +00:00
should show you available shares (example /home)
2021-08-15 17:39:13 +00:00
mount -t nfs -o ver=2 10.10.10.180:/home /mnt/
cd /mnt
nano into /etc/passwd and change the uid (probably 1000 or 1001) to match the owner of the files if you are not able to get in
2021-08-12 12:55:42 +00:00
2021-08-15 17:39:13 +00:00
https://book.hacktricks.xyz/pentesting/nfs-service-pentesting
2021-08-12 12:55:42 +00:00
2021-08-15 17:39:13 +00:00
Entry_2:
Name: Nmap
Description: Nmap with NFS Scripts
2021-09-19 09:07:30 +00:00
Command: nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 {IP}
2021-08-12 12:55:42 +00:00
```