# Network File System (NFS) Introduction - developed by Sun with the same purpose as SMB - based on ONC-RPC/SUN-RPC exposed on TCP/UDP111 - usually used between Linux/Unix systems - cannot communicate with SMB servers - no mechanism for authentication or authorization - most common authentication is via unix UID/GID and group memberships ## Footprinting NFS ```bash sudo nmap <ip_addr> -sC -sV -p111,2049 sudo nmap --script nfs* <ip_addr> -sV -p111,2049 #nfs related NSE scripts: nfs-ls, nfs-showmount, nfs-statfs, rpcinfo ``` ## NFS Share Discovery and Mounting ```bash showmount -e <ip_addr> #discover NFS shares #steps for mounting an enumerating remote shares mkdir target-NFS sudo mount -t nfs <ip_adddr>:/ ./NFS/ -o nolock #mount NFS share sudo ls -al ~/path/NFS #list contents with usernames and group names sudo ls -n ~/path/NFS/ #list contents with UIDs and GIDs sudo cat ~/path/NFS #show contents of file #if necessary add local user to associated group/GIOD to access #sudo usermod -aG new_group_name user_name sudo umount ./target-NFS #unmount ``` ## NFS Config - `/etc/exports` contains a table of physical filesystems on an NFS server that are accessible by clients - also includes share-specific options ```bash cat /etc/exports echo '/mnt/nfs <ip_addr>/24(sync,no_subtree_check)' >> /etc/exports #share test share to subnet with specified settings sudo systemctl restart nfs-kernel-server exportfs ``` | NFS Share Option | Description | | ---------------- | -------------------------------------------------------------------------------------------------------------------------------- | | rw | read and write perm | | ro | read only perm | | sync | synchronous data transfer (slower) | | async | asynchronous data transfer | | secure | ports above 1024 wont be used | | insecure | ports above 1024 will be used | | nohide | if another fs was mounted below an exported directory, this directory is exported by its own exports entry | | no_subtree_check | disabels checking of subdirectory trees | | root_squash | assigns all perms to files of root UID/GID to the UID/GID of anonymous, which precents root from accessing fiels on an NFS mount | ## NFS Version History | Version | Features | | ------- | ----------------------------------------------------------------------------------- | | NFSv2 | older but still supported on many systems; operates entirely over UDP | | NFSv3 | not fully compatible with NFSv2; more features: variable file size, error reporting | | NFSv4 | includes Kerboeros; supports ACLs; performance improvements and high security |