> For the complete documentation index, see [llms.txt](https://chinnidiwakar.gitbook.io/githubimport/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chinnidiwakar.gitbook.io/githubimport/pentesting/nfs-service-pentesting.md).

# 2049 - Pentesting NFS Service

## **Basic Information**

It is a client/server system that allows users to access files across a network and treat them as if they resided in a local file directory.

**Default port**: 2049

```
2049/tcp open  nfs     2-3 (RPC #100003
```

## Enumeration

### Useful nmap scripts

```bash
nfs-ls #List NFS exports and check permissions
nfs-showmount #Like showmount -e
nfs-statfs #Disk statistics and info from NFS share
```

### Useful metasploit modules

```bash
scanner/nfs/nfsmount #Scan NFS mounts and list permissions
```

### Mounting

To know **which folder** has the server **available** to mount you an ask it using:

```bash
showmount -e <IP>
```

Then mount it using:

```bash
mount -t nfs [-o vers=2] <ip>:<remote_folder> <local_folder> -o nolock
```

You should specify to **use version 2** because it doesn't have **any** **authentication** or **authorization**.

**Example:**

```bash
mkdir /mnt/new_back
mount -t nfs [-o vers=2] 10.12.0.150:/backup /mnt/new_back -o nolock
```

## Permissions

If you mount a folder which contains **files or folders only accesible by some user** (by **UID**). You can **create** **locally** a user with that **UID** and using that **user** you will be able to **access** the file/folder.

## NSFShell

To easily list, mount and change UID and GID to have access to files you can use [nfsshell](https://github.com/NetDirect/nfsshell).

[Nice NFSShell tutorial.](https://www.pentestpartners.com/security-blog/using-nfsshell-to-compromise-older-environments/)

## Config files

```
/etc/exports
/etc/lib/nfs/etab
```

## Privilege Escalation using NFS misconfigurations

[NFS no\_root\_squash and no\_all\_squash privilege escalation](/githubimport/linux-unix/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.md)