37. Enumeration: NetBIOS, SMB, SNMP, LDAP, SMTP, NFS and DNS
37.6 NFS Enumeration
NFS (Network File System) – Linux file shares over the network. Portmapper 111, NFS 2049. Misconfigured export = remote folder mount, sometimes with write / root rights.
# What is exported? (Metasploitable classic finding)
showmount -e 192.168.56.20
rpcinfo -p 192.168.56.20
# If an export allows your IP – mount read-only first in lab
sudo mkdir -p /mnt/nfs-lab
sudo mount -t nfs -o ro,vers=3 192.168.56.20:/ /mnt/nfs-lab
ls -la /mnt/nfs-lab
sudo umount /mnt/nfs-lab
Risk: * world-readable exports, no_root_squash (remote root = local root – khup kharab). Sensitive keys/configs share madhe asu shaktat.
Defence: /etc/exports madhe specific IPs only; root_squash (default – theva); read-only where possible; firewall 111/2049; NFSv4 + Kerberos where needed; never export / or /etc to *. He lakshat theva.
Ravindra Bagale's Tip
Students showmount -e success baghun thate no_root_squash mount kartat aani files delete. Lab madhe pan read-only (-o ro) aadhi. Production finding asel tar report + fix – destroy nako. root_squash naav memorise kara – interview favourite.
Lab
showmount -e 192.168.56.20 chalaa. Export list note kara. Jar mount allow asel tar read-only mount karun 3 interesting files/folders note kara, mag umount. Aaplya notes madhe ek safe /etc/exports example liha: specific subnet + root_squash + ro.