# 2049 - Pentesting NFS Service
Support HackTricks and get benefits! Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
## **Basic Information** It is a client/server system that allows users to access files across a network and treat them as if they resided in a local file directory. **Default port**: 2049 ``` 2049/tcp open nfs 2-3 (RPC #100003 ``` ## Enumeration ### Useful nmap scripts ```bash nfs-ls #List NFS exports and check permissions nfs-showmount #Like showmount -e nfs-statfs #Disk statistics and info from NFS share ``` ### Useful metasploit modules ```bash scanner/nfs/nfsmount #Scan NFS mounts and list permissions ``` ### Mounting To know **which folder** has the server **available** to mount you an ask it using: ```bash showmount -e ``` Then mount it using: ```bash mount -t nfs [-o vers=2] : -o nolock ``` You should specify to **use version 2** because it doesn't have **any** **authentication** or **authorization**. **Example:** ```bash mkdir /mnt/new_back mount -t nfs [-o vers=2] 10.12.0.150:/backup /mnt/new_back -o nolock ``` ## Permissions If you mount a folder which contains **files or folders only accesible by some user** (by **UID**). You can **create** **locally** a user with that **UID** and using that **user** you will be able to **access** the file/folder. ## NSFShell To easily list, mount and change UID and GID to have access to files you can use [nfsshell](https://github.com/NetDirect/nfsshell). [Nice NFSShell tutorial.](https://www.pentestpartners.com/security-blog/using-nfsshell-to-compromise-older-environments/) ## Config files ``` /etc/exports /etc/lib/nfs/etab ``` ## Privilege Escalation using NFS misconfigurations [NFS no\_root\_squash and no\_all\_squash privilege escalation](../linux-hardening/privilege-escalation/nfs-no\_root\_squash-misconfiguration-pe.md) ## HackTricks Automatic Commands ``` Protocol_Name: NFS #Protocol Abbreviation if there is one. Port_Number: 2049 #Comma separated if there is more than one. Protocol_Description: Network File System #Protocol Abbreviation Spelled out Entry_1: Name: Notes Description: Notes for NFS Note: | It is a client/server system that allows users to access files across a network and treat them as if they resided in a local file directory. #apt install nfs-common showmount 10.10.10.180 ~or~showmount -e 10.10.10.180 should show you available shares (example /home) mount -t nfs -o ver=2 10.10.10.180:/home /mnt/ cd /mnt nano into /etc/passwd and change the uid (probably 1000 or 1001) to match the owner of the files if you are not able to get in https://book.hacktricks.xyz/pentesting/nfs-service-pentesting Entry_2: Name: Nmap Description: Nmap with NFS Scripts Command: nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 {IP} ```
Support HackTricks and get benefits! Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**