NFS Enumeration

Goals

• To scan for NFS share

Install client

• apt-get install nfs-common

To scan all NFS info

• nmap -sV --script=nfs* victim-ip -T4

Enumerate NFS share

• nmap -sV --script=nfs-ls victim-ip
• showmount -e victim-ip

Check for no_all_squash

By enabling the root_squash, we can’t just get root privileges on the remote filesystem.

However, no_all_squash is enabled we can be authorized as any other user.

• If already in the system: cat /etc/exports
• /var/nfsshare *(rw,sync,root_squash,no_all_squash)
• /opt *(rw,sync,root_squash,no_all_squash)

Mount NFS

To create user with uid and gid as owner of NFS folder in Victim PC.

• mkdir /tmp/nfsshare
• mount -t nfs -o vers=3 victim-ip:/var/nfsshare /tmp/nfsshare
• NFS ver 3 don't have authentication.