73 lines
1.8 KiB
Markdown
73 lines
1.8 KiB
Markdown
# 2049 - Pentesting NFS Service
|
|
|
|
## **Basic Information**
|
|
|
|
It is a client/server system that allows users to access files across a network and treat them as if they resided in a local file directory.
|
|
|
|
**Default port**: 2049
|
|
|
|
```text
|
|
2049/tcp open nfs 2-3 (RPC #100003
|
|
```
|
|
|
|
## Enumeration
|
|
|
|
### Useful nmap scripts
|
|
|
|
```bash
|
|
nfs-ls #List NFS exports and check permissions
|
|
nfs-showmount #Like showmount -e
|
|
nfs-statfs #Disk statistics and info from NFS share
|
|
```
|
|
|
|
### Useful metasploit modules
|
|
|
|
```bash
|
|
scanner/nfs/nfsmount #Scan NFS mounts and list permissions
|
|
```
|
|
|
|
### Mounting
|
|
|
|
To know **which folder** has the server **available** to mount you an ask it using:
|
|
|
|
```bash
|
|
showmount -e <IP>
|
|
```
|
|
|
|
Then mount it using:
|
|
|
|
```bash
|
|
mount -t nfs [-o vers=2] <ip>:<remote_folder> <local_folder> -o nolock
|
|
```
|
|
|
|
You should specify to **use version 2** because it doesn't have **any** **authentication** or **authorization**.
|
|
|
|
**Example:**
|
|
|
|
```bash
|
|
mkdir /mnt/new_back
|
|
mount -t nfs [-o vers=2] 10.12.0.150:/backup /mnt/new_back -o nolock
|
|
```
|
|
|
|
## Permissions
|
|
|
|
If you mount a folder which contains **files or folders only accesible by some user** \(by **UID**\). You can **create** **locally** a user with that **UID** and using that **user** you will be able to **access** the file/folder.
|
|
|
|
## NSFShell
|
|
|
|
To easily list, mount and change UID and GID to have access to files you can use [nfsshell](https://github.com/NetDirect/nfsshell).
|
|
|
|
[Nice NFSShell tutorial.](https://www.pentestpartners.com/security-blog/using-nfsshell-to-compromise-older-environments/)
|
|
|
|
## Config files
|
|
|
|
```text
|
|
/etc/exports
|
|
/etc/lib/nfs/etab
|
|
```
|
|
|
|
## Privilege Escalation using NFS misconfigurations
|
|
|
|
[NFS no\_root\_squash and no\_all\_squash privilege escalation](../linux-unix/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.md)
|
|
|