Skip to content
HackIndex logo

HackIndex

NFS World-Readable Exports

3 min read May 15, 2026

NFS exports with a wildcard client list (*) or insecure options are accessible from any host that can reach the NFS port. Even read-only exports with no authentication expose the full directory tree — SSH keys, config files, credentials, and application secrets are common finds on exposed home directories and web roots.

Identify Open Exports

Check the client restriction on each export. A wildcard or broad subnet means any host in range can mount:

┌──(kali㉿kali)-[~]
└─$ showmount -e $TARGET_IP 
Export list for 10.10.10.50:
/home/jsmith   *
/var/www/html  10.0.0.0/8
/backup        192.168.1.0/24

* on /home/jsmith = accessible from anywhere. /var/www/html restricted to a /8 is still wide — any host in that range can mount without credentials.

Confirm Mountability Without Credentials

Mount attempts require no authentication — if the export list shows the host, mounting succeeds:

┌──(kali㉿kali)-[~]
└─$ mkdir /mnt/nfs_test
┌──(kali㉿kali)-[~]
└─$ mount -t nfs -o nolock $TARGET_IP:/home/jsmith /mnt/nfs_test
┌──(kali㉿kali)-[~]
└─$ ls /mnt/nfs_test 
total 48
drwxr-xr-x 5 1001 1001 4096 May 01 09:22 .
drwxr-xr-x 3 root root 4096 Jan 10 11:05 ..
-rw------- 1 1001 1001  220 Jan 10 11:05 .bash_history
drwx------ 2 1001 1001 4096 Jan 10 11:05 .ssh
-rw-r--r-- 1 1001 1001  807 Jan 10 11:05 .profile

Successful mount with directory listing confirms unauthenticated read access. UID-based permissions still apply — files owned by the user may appear as unreadable if UID does not match. See NFS UID Spoofing to bypass UID restrictions.

Assess Accessible Content

After mounting, check for high-value files regardless of apparent permissions:

┌──(kali㉿kali)-[~]
└─$ # SSH keys
┌──(kali㉿kali)-[~]
└─$ ls -la /mnt/nfs_test/.ssh/
 
┌──(kali㉿kali)-[~]
└─$ # Shell history (may contain credentials)
┌──(kali㉿kali)-[~]
└─$ cat /mnt/nfs_test/.bash_history
 
┌──(kali㉿kali)-[~]
└─$ # Config files
┌──(kali㉿kali)-[~]
└─$ find /mnt/nfs_test -name "*.conf" -o -name "*.ini" -o -name "*.env" 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ # World-readable files (accessible without UID match)
┌──(kali㉿kali)-[~]
└─$ find /mnt/nfs_test -perm -o+r -type f 2>/dev/null

.ssh/authorized_keys is writable if the share is read-write or if UID spoofing is available — see NFS World-Readable Share Exploitation for the full extraction workflow.

Check for insecure and no_subtree_check Options

These options weaken NFS further beyond open client lists:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 --script nfs-ls $TARGET_IP 
| nfs-ls: Volume /home/jsmith
|   NFS: (rw,insecure,no_subtree_check,anonuid=1001,anongid=1001)

Option

Meaning

insecure

Allows connections from unprivileged ports (above 1024) — bypasses old NFS client restriction

no_subtree_check

Disables path validation — clients can access files outside the exported directory via filehandle guessing

anonuid=X

Anonymous (unauthenticated) access maps to UID X — if X is a real user, anonymous clients get that user's access

anonuid set to a non-nobody UID means unauthenticated mounts get real user access without any UID spoofing needed.

Scan Subnet for Exposed NFS

In an internal engagement, scan the full subnet for exposed NFS:

┌──(kali㉿kali)-[~]
└─$ nmap -p 111,2049 --open $SUBNET/24 -oG - | grep "open" | awk '{print $2}' | while read host; do
echo "=== $host ==="; showmount -e $host 2>/dev/null
done

Any host responding to showmount with a wildcard export is immediately mountable.

References