mirror of https://github.com/carlospolop/hacktricks synced 2024-11-15 01:17:36 +00:00

Carlos Polop ed03e5afcf a

2024-07-19 01:15:55 +02:00

8.1 KiB

Raw Blame History

2049 - Pentesting NFS Service

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

Basic Information

NFS is a system designed for client/server that enables users to seamlessly access files over a network as though these files were located within a local directory.

A notable aspect of this protocol is its lack of built-in authentication or authorization mechanisms. Instead, authorization relies on file system information, with the server tasked with accurately translating client-provided user information into the file system's required authorization format, primarily following UNIX syntax.

Authentication commonly relies on UNIX UID/GID identifiers and group memberships. However, a challenge arises due to the potential mismatch in UID/GID mappings between clients and servers, leaving no room for additional verification by the server. Consequently, the protocol is best suited for use within trusted networks, given its reliance on this method of authentication.

Default port: 2049/TCP/UDP (except version 4, it just needs TCP or UDP).

2049/tcp open  nfs     2-3 (RPC #100003

Versions

NFSv2: This version is recognized for its broad compatibility with various systems, marking its significance with initial operations predominantly over UDP. Being the oldest in the series, it laid the groundwork for future developments.
NFSv3: Introduced with an array of enhancements, NFSv3 expanded on its predecessor by supporting variable file sizes and offering improved error reporting mechanisms. Despite its advancements, it faced limitations in full backward compatibility with NFSv2 clients.
NFSv4: A landmark version in the NFS series, NFSv4 brought forth a suite of features designed to modernize file sharing across networks. Notable improvements include the integration of Kerberos for high security, the capability to traverse firewalls and operate over the Internet without the need for portmappers, support for Access Control Lists (ACLs), and the introduction of state-based operations. Its performance enhancements and the adoption of a stateful protocol distinguish NFSv4 as a pivotal advancement in network file sharing technologies.

Each version of NFS has been developed with the intent to address the evolving needs of network environments, progressively enhancing security, compatibility, and performance.

Enumeration

Useful nmap scripts

nfs-ls #List NFS exports and check permissions
nfs-showmount #Like showmount -e
nfs-statfs #Disk statistics and info from NFS share

Useful metasploit modules

scanner/nfs/nfsmount #Scan NFS mounts and list permissions

Mounting

To know which folder has the server available to mount you an ask it using:

showmount -e <IP>

Then mount it using:

mount -t nfs [-o vers=2] <ip>:<remote_folder> <local_folder> -o nolock

You should specify to use version 2 because it doesn't have any authentication or authorization.

Example:

mkdir /mnt/new_back
mount -t nfs [-o vers=2] 10.12.0.150:/backup /mnt/new_back -o nolock

Permissions

If you mount a folder which contains files or folders only accesible by some user (by UID). You can create locally a user with that UID and using that user you will be able to access the file/folder.

NSFShell

To easily list, mount and change UID and GID to have access to files you can use nfsshell.

Nice NFSShell tutorial.

Config files

/etc/exports
/etc/lib/nfs/etab

Dangerous settings

Read and Write Permissions (rw): This setting allows both reading from and writing to the file system. It's essential to consider the implications of granting such broad access.
Use of Insecure Ports (insecure): When enabled, this allows the system to utilize ports above 1024. The security of ports above this range can be less stringent, increasing risk.
Visibility of Nested File Systems (nohide): This configuration makes directories visible even if another file system is mounted below an exported directory. Each directory requires its own export entry for proper management.
Root Files Ownership (no_root_squash): With this setting, files created by the root user maintain their original UID/GID of 0, disregarding the principle of least privilege and potentially granting excessive permissions.
Non-Squashing of All Users (no_all_squash): This option ensures that user identities are preserved across the system, which could lead to permission and access control issues if not correctly handled.

Privilege Escalation using NFS misconfigurations

NFS no_root_squash and no_all_squash privilege escalation

HackTricks Automatic Commands

Protocol_Name: NFS    #Protocol Abbreviation if there is one.
Port_Number:  2049     #Comma separated if there is more than one.
Protocol_Description: Network File System         #Protocol Abbreviation Spelled out

Entry_1:
  Name: Notes
  Description: Notes for NFS
  Note: |
    NFS is a system designed for client/server that enables users to seamlessly access files over a network as though these files were located within a local directory. 

    #apt install nfs-common
    showmount 10.10.10.180      ~or~showmount -e 10.10.10.180
    should show you available shares (example /home)

    mount -t nfs -o ver=2 10.10.10.180:/home /mnt/
    cd /mnt
    nano into /etc/passwd and change the uid (probably 1000 or 1001) to match the owner of the files if you are not able to get in

    https://book.hacktricks.xyz/pentesting/nfs-service-pentesting

Entry_2:
  Name: Nmap
  Description: Nmap with NFS Scripts
  Command: nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 {IP}