Mounting NFS Shares

Local mount enables full filesystem access. no_root_squash or UID mismatches often grant elevated privileges.

Standard Mount

Export from showmount:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ sudo mount -t nfs $TARGET_IP:/export/path /mnt/nfs

List contents:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ ls -la /mnt/nfs

Numeric owners:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ ls -ln /mnt/nfs

Root-owned files indicate potential escalation.

Version and Option Variants

Force NFSv3:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ sudo mount -t nfs -o vers=3 $TARGET_IP:/export/path /mnt/nfs

Disable locking for older servers:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ sudo mount -t nfs -o nolock $TARGET_IP:/export/path /mnt/nfs

Combine:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ sudo mount -t nfs -o vers=3,nolock $TARGET_IP:/export/path /mnt/nfs

Sensitive File Hunting

Configs and keys:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ find /mnt/nfs -type f \( -name "*.conf" -o -name "*.config" -o -name "*.key" -o -name "*.pem" -o -name "*.bak" \)

Root-owned:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ find /mnt/nfs -uid 0 -ls

Cleanup

Unmount after:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ sudo umount /mnt/nfs