NFS

NFS (Network File System)

Network File System (NFS) is a protocol used for sharing files over a network, allowing a user on a client computer to access files over a computer network much like local storage. During the footprinting phase of a penetration test, identifying and misconfiguring NFS shares can lead to significant data exposure or a foothold into the system. Side Note:

NFS -> Linux SMB -> Windows

NFS typically runs on:

• TCP port 111

• TCP port 2049

• UDP port 111

• UDP port 2049

The file /etc/exports on the NFS server controls which folders are shared and who is allowed to access them.

---

Why NFS Can Be Dangerous

If NFS is misconfigured, attackers may be able to:

• Read sensitive files

• Modify or delete data

• Upload malicious files

• Steal credentials

Many servers accidentally expose NFS shares to everyone.

---

Scanning for NFS

sudo nmap 10.10.10.10 -p 111,2049 -sV -sC

This checks whether the NFS ports are open, what version is running, and whether default scripts find anything interesting.

---

What is RPC?

NFS relies on RPC (Remote Procedure Call). RPC allows one computer to request services or functions from another computer over the network.

NFS uses RPC to ask what folders are shared and who is allowed to access them.

---

Enumerating NFS Services

sudo nmap --script nfs* 10.10.10.10 -sV -p 111,2049

This can reveal:

• Shared directories

• Permissions

• Export configuration

---

Viewing Available NFS Shares

showmount -e 10.10.10.10

Example output:

/home   *
/backup 192.168.1.0/24

The * means anyone can access that share.

---

Mounting an NFS Share

mkdir target-NFS
sudo mount -t nfs 10.10.10.10:/ target-NFS -o nolock
cd target-NFS
tree .

You are now browsing the remote server’s files locally.

---

Listing Files With Usernames

ls -l

Shows file owners, group names, and permissions.

---

Listing Files With User and Group IDs

ls -n

Shows numeric UIDs and GIDs. Files owned by UID 0 belong to root.

---

Why Attackers Target NFS

If an NFS share is configured with:

• no_root_squash

• or shared to *

Attackers can:

• Upload files as root

• Replace system files

• Add SSH keys

• Fully compromise the server

Demo

┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~]
└──╼ [★]$ sudo nmap 10.129.202.5 -p 111,2049 -sV -sC
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-12-25 19:15 CST
Nmap scan report for 10.129.202.5
Host is up (0.0084s latency).

PORT     STATE SERVICE VERSION
111/tcp  open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3           2049/udp   nfs
|   100003  3           2049/udp6  nfs
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      42315/tcp   mountd
|   100005  1,2,3      55255/udp6  mountd
|   100005  1,2,3      56084/udp   mountd
|   100005  1,2,3      58895/tcp6  mountd
|   100021  1,3,4      39605/tcp   nlockmgr
|   100021  1,3,4      41545/tcp6  nlockmgr
|   100021  1,3,4      49385/udp   nlockmgr
|   100021  1,3,4      57990/udp6  nlockmgr
|   100227  3           2049/tcp   nfs_acl
|   100227  3           2049/tcp6  nfs_acl
|   100227  3           2049/udp   nfs_acl
|_  100227  3           2049/udp6  nfs_acl
2049/tcp open  nfs     3-4 (RPC #100003)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.45 seconds
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~]
└──╼ [★]$ sudo nmap --script nfs* 10.129.202.5 -sV -p 111,2049
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-12-25 19:16 CST
Nmap scan report for 10.129.202.5
Host is up (0.0085s latency).

PORT     STATE SERVICE VERSION
111/tcp  open  rpcbind 2-4 (RPC #100000)
| nfs-showmount: 
|   /var/nfs 10.0.0.0/8
|_  /mnt/nfsshare 10.0.0.0/8
| nfs-statfs: 
|   Filesystem     1K-blocks  Used       Available  Use%  Maxfilesize  Maxlink
|   /var/nfs       5090944.0  3256144.0  1766036.0  65%   16.0T        32000
|_  /mnt/nfsshare  5090944.0  3256144.0  1766036.0  65%   16.0T        32000
|_rpcinfo: ERROR: Script execution failed (use -d to debug)
| nfs-ls: Volume /var/nfs
|   access: Read Lookup Modify Extend Delete NoExecute
| PERMISSION  UID    GID    SIZE  TIME                 FILENAME
| rwxr-xr-x   65534  65534  4096  2021-11-08T15:08:27  .
| ??????????  ?      ?      ?     ?                    ..
| rw-r--r--   65534  65534  39    2021-11-08T15:08:27  flag.txt
| 
| 
| Volume /mnt/nfsshare
|   access: Read Lookup Modify Extend Delete NoExecute
| PERMISSION  UID    GID    SIZE  TIME                 FILENAME
| rwxr-xr-x   65534  65534  4096  2021-11-08T14:06:40  .
| ??????????  ?      ?      ?     ?                    ..
| rw-r--r--   65534  65534  59    2021-11-08T14:06:40  flag.txt
|_
2049/tcp open  nfs     3-4 (RPC #100003)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.72 seconds
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~]
└──╼ [★]$ showmount -e 10.129.202.5
Export list for 10.129.202.5:
/var/nfs      10.0.0.0/8
/mnt/nfsshare 10.0.0.0/8
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~]
└──╼ [★]$ mkdir target
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~]
└──╼ [★]$ sudo mount -t nfs 10.129.202.5:/ target -o nolock
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~]
└──╼ [★]$ cd target/
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~/target]
└──╼ [★]$ ls
mnt  var
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~/target]
└──╼ [★]$ cd mnt/
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~/target/mnt]
└──╼ [★]$ ls
nfsshare
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~/target/mnt]
└──╼ [★]$ cd nfsshare/
┌─[us-academy-6]─[10.10.14.10]─[htb-ac-1399625@htb-97fauuodkl]─[~/target/mnt/nfsshare]
└──╼ [★]$ ls
flag.txt