Skip to content
HackIndex.io

Mounting NFS Shares

4 min read Created Jan 4, 2026 Last updated Jan 4, 2026

Local mount gives you direct filesystem access to the exported path. NFS relies on UID-based ownership rather than username lookups. If the server exports with no_root_squash, your local root account maps directly to root on the server. Even without that misconfiguration, you can match any file owner by creating a local user with the same UID. Run showmount -e $TARGET_IP first to identify all available export paths before attempting to mount.

Key mount considerations:

  • Use -o nolock to avoid NLM issues on older servers

  • Specify NFS version with -o vers=3 or -o vers=2 for legacy targets

  • Check file ownership UIDs to plan UID spoofing

Mounting NFS shares with standard options

Use the full export path returned by showmount:

┌──(kali㉿kali)-[~]
└─$ sudo mount -t nfs $TARGET_IP:/export/path /mnt/nfs

Scan the mounted share immediately after mounting. Look for configuration files, credential stores, SSH keys, and web application directories. Pay attention to file timestamps as recently modified files are more likely to contain active credentials.

List contents with permissions:

┌──(kali㉿kali)-[~]
└─$ ls -la /mnt/nfs

Numeric UIDs reveal ownership mismatches. A file owned by UID 1001 means a local account with UID 1001 on your machine has the same access. Cross-reference against the server's /etc/passwd if you can read it. Create a matching local user to impersonate that owner.

Numeric owners:

┌──(kali㉿kali)-[~]
└─$ ls -ln /mnt/nfs

Root-owned files are worth examining even if they appear read-only. SUID binaries owned by root are the most valuable find. A SUID binary on the share can be executed locally, giving you root-level execution on your attacker machine.

If the standard mount command fails or returns an error, the server may require an older NFS version. NFSv3 is stateless and skips some of the version-negotiation overhead. NFSv4 introduced stronger access controls and Kerberos integration, so forcing v3 sometimes bypasses those layers.

Version and Option Variants

Force NFSv3:

┌──(kali㉿kali)-[~]
└─$ sudo mount -t nfs -o vers=3 $TARGET_IP:/export/path /mnt/nfs

Some older NFS daemons do not run the network lock manager correctly. When locking is active, the mount may hang waiting for rpc.statd to respond. The nolock option bypasses the lock protocol entirely and lets the mount complete without it.

Disable locking for older servers:

┌──(kali㉿kali)-[~]
└─$ sudo mount -t nfs -o nolock $TARGET_IP:/export/path /mnt/nfs

Use both options together when targeting servers that exhibit both problems. This combination is common on embedded Linux devices, older NAS appliances, and CTF targets running legacy NFS configurations.

Combine both options:

┌──(kali㉿kali)-[~]
└─$ sudo mount -t nfs -o vers=3,nolock $TARGET_IP:/export/path /mnt/nfs

Sensitive File Hunting

Once mounted, search systematically. Application config files often contain database credentials, API keys, or internal hostnames. Private keys grant SSH or TLS access without password guessing. Backup files frequently include plaintext credentials from a previous deployment. The find command below covers common extensions worth reviewing.

Configs and keys:

┌──(kali㉿kali)-[~]
└─$ find /mnt/nfs -type f \( -name "*.conf" -o -name "*.config" -o -name "*.key" -o -name "*.pem" -o -name "*.bak" \)

Files owned by UID 0 with world-readable permissions are accessible from your attacker machine without privilege matching. Look for cron scripts, init files, and system configs in this output. Any writable file owned by root is a direct privilege escalation path if you can modify it.

Root-owned files:

┌──(kali㉿kali)-[~]
└─$ find /mnt/nfs -uid 0 -ls

Cleanup

Unmount the share when done. Stale NFS mounts can cause the directory to become unresponsive and may leave connection state on the server. If the mount point is busy, use umount -l for a lazy unmount that detaches immediately and cleans up when the last process releases it.

Unmount after:

┌──(kali㉿kali)-[~]
└─$ sudo umount /mnt/nfs