37. Enumeration: NetBIOS, SMB, SNMP, LDAP, SMTP, NFS and DNS
37.6 NFS Enumeration
NFS (Network File System) – Linux file shares over the network. Portmapper 111, NFS 2049. Misconfigured export = remote folder mount, sometimes with write / root rights.
# What is exported? (Metasploitable classic finding)
showmount -e 192.168.56.20
rpcinfo -p 192.168.56.20
# If an export allows your IP – mount read-only first in lab
sudo mkdir -p /mnt/nfs-lab
sudo mount -t nfs -o ro,vers=3 192.168.56.20:/ /mnt/nfs-lab
ls -la /mnt/nfs-lab
sudo umount /mnt/nfs-lab
Risk: * world-readable exports, no_root_squash (remote root = local root – khup kharab). Sensitive keys/configs share madhe asu shaktat.
Defence: /etc/exports madhe specific IPs only; root_squash (default – theva); read-only where possible; firewall 111/2049; NFSv4 + Kerberos where needed; never export / or /etc to *. He lakshat theva.
Ravindra Bagale's Tip
Students see showmount -e succeed and directly mount the no_root_squash share and delete files. Even in the lab, mount read-only (-o ro) first. If it's a production finding, report + fix – don't destroy. Memorise the name root_squash – an interview favourite.
Ravindra Bagale's Tip – मराठी
Students showmount -e success बघून थेट no_root_squash mount करतात आणि files delete करतात. Lab मध्ये पण read-only (-o ro) आधी. Production finding असेल तर report + fix – destroy नको. root_squash नाव लक्षात ठेवा – interview favourite.
Ravindra Bagale's Tip – हिंदी
Students showmount -e success देखकर सीधे no_root_squash mount करते हैं और files delete कर देते हैं. Lab में भी read-only (-o ro) पहले. Production finding हो तो report + fix – destroy नहीं. root_squash नाम याद रखो – interview favourite.
Lab
showmount -e 192.168.56.20 chalaa. Export list note kara. Jar mount allow asel tar read-only mount karun 3 interesting files/folders note kara, mag umount. Aaplya notes madhe ek safe /etc/exports example liha: specific subnet + root_squash + ro.