Skip to content
HackIndex logo

HackIndex

NFS no_root_squash Detection

3 min read May 15, 2026

By default, NFS maps root (UID 0) from clients to the anonymous user nfsnobody on the server — this is root squashing. When no_root_squash is set on an export, root on any permitted client retains root privileges on the mounted share. Writing a SUID binary or injecting an SSH key from a client with local root gives full access to the server account that owns the share.

Read Export Options via showmount

showmount -e lists exports but does not show options. Options are visible in the server's /etc/exports if you have read access, or via the NFS mount response:

┌──(kali㉿kali)-[~]
└─$ showmount -e $TARGET_IP 
Export list for 10.10.10.50:
/home/backup *
/data        10.10.10.0/24

showmount shows paths and client access lists but not mount options. Use nmap to retrieve options:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 --script nfs-showmount $TARGET_IP 
| nfs-showmount:
|   /home/backup (everyone)
|_  /data (10.10.10.0/24)

Check Export Options with nmap

The nfs-ls script retrieves export options including squash settings:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 --script nfs-ls $TARGET_IP 
| nfs-ls: Volume /home/backup
|   access: Read Lookup NoModify NoExtend NoDelete NoExecute
| nfs-ls: Volume /data
|   access: Read Lookup Modify Extend Delete Execute
|   NFS: (rw,no_root_squash,no_subtree_check)

no_root_squash in the options field is a confirmed misconfiguration. rw combined with no_root_squash is exploitable — write a SUID binary or inject SSH keys as a client with local root.

Mount and Check Effective Permissions

Mount the export and verify effective UID mapping:

┌──(kali㉿kali)-[~]
└─$ mkdir /mnt/nfs_check
┌──(kali㉿kali)-[~]
└─$ mount -t nfs $TARGET_IP:/data /mnt/nfs_check

Check how root maps on the server side:

┌──(kali㉿kali)-[~]
└─$ ls -la /mnt/nfs_check/

If files are owned by root and writable, root squashing is off. Create a test file as root on the client:

┌──(kali㉿kali)-[~]
└─$ touch /mnt/nfs_check/root_test
┌──(kali㉿kali)-[~]
└─$ ls -la /mnt/nfs_check/root_test 
-rw-r--r-- 1 root root 0 May 15 14:22 root_test

File owned by root (not nfsnobody or 65534) confirms no_root_squash. Clean up:

┌──(kali㉿kali)-[~]
└─$ rm /mnt/nfs_check/root_test
┌──(kali㉿kali)-[~]
└─$ umount /mnt/nfs_check

Read /etc/exports Directly

If the share exposes the filesystem root or /etc:

┌──(kali㉿kali)-[~]
└─$ cat /mnt/nfs_check/etc/exports 
/data           *(rw,no_root_squash,no_subtree_check)
/home/backup    *(ro,root_squash)

Direct read of /etc/exports shows all exports and their options in one step. Also check /etc/exports.d/ for split config files.

Impact Classification

Export options

Impact

rw,no_root_squash

Full root write — SUID shell, SSH key injection, direct file overwrite

ro,no_root_squash

Root read — access to all files regardless of permissions, readable shadow/passwd

rw,root_squash

UID spoofing only — see NFS UID Spoofing

ro,root_squash

Read access limited to world-readable files

no_root_squash on a read-write export is the highest-severity NFS misconfiguration. For the full exploitation workflow see NFS no_root_squash Abuse.

References