NFS Attacks
Version
Features
NFSv2
It is older but is supported by many systems and was initially operated entirely over [[UDP]].
NFSv3
It has more features, including variable file size and better error reporting, but is not fully compatible with NFSv2 clients.
NFSv4
It includes [[Kerberos]], works through [[firewalls]] and on the Internet, no longer requires portmappers, supports ACLs, applies state-based operations, and provides performance improvements and high security. It is also the first version to have a stateful protocol.
uses Remote Procedure Call (RPC)
Default Configuration
cat /etc/exports # /etc/exports: the access control list for filesystems which may be exported
# to NFS clients. See exports(5).
#
# Example for NFSv2 and NFSv3:
# /srv/homes hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
#
# Example for NFSv4:
# /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check)Option
Description
rw
Read and write permissions.
ro
Read only permissions.
sync
Synchronous data transfer. (A bit slower)
async
Asynchronous data transfer. (A bit faster)
secure
Ports above 1024 will not be used.
insecure
Ports above 1024 will be used.
no_subtree_check
This option disables the checking of subdirectory trees.
root_squash
Assigns all permissions to files of root UID/GID 0 to the UID/GID of anonymous, which prevents root from accessing files on an NFS mount.
Dangerous Settings
Option
Description
rw
Read and write permissions.
insecure
Ports above 1024 will be used.
nohide
If another file system was mounted below an exported directory, this directory is exported by its own exports entry.
no_root_squash
All files created by root are kept with the UID/GID 0.
Footprinting the Service
When foot printing NFS, the TCP ports
111and2049are essential
Nmap
[[Nmap]]
Nmap Script Offensive
Show Available NFS Shares
Mounting NFS Share
List Contents with Usernames & Group Names
List Contents with UIDs & GUIDs
Unmounting
Last updated