skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-nfs

Tests NFS services for export enumeration, UID impersonation, and squash misconfigurations during authorized engagements.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#enumeration#nfs#network services#Privilege escalation#no_root_squash#showmount
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-nfs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-nfs
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-nfs
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-nfs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

NFS shares are frequently misconfigured with missing authentication, no_root_squash, or subtree_check disabled, yet testers often miss these issues because enumeration tools only list exports without validating exploitability. This Skill provides a structured workflow to enumerate, mount, and actively verify NFS weaknesses on port 2049 during authorized penetration tests.

Core Features & Use Cases

  • Export and RPC Enumeration: Uses showmount, rpcinfo, nmap NSE scripts, and Metasploit to discover exports, mountd, and RPC programs across NFS versions.
  • Misconfiguration Verification: Confirms UID/GID impersonation, no_root_squash, no_all_squash, and subtree_check export escapes with concrete proof steps such as planting SUID shells or reading /etc/shadow.
  • Use Case: During an internal network assessment, a tester finds showmount lists /srv exported to all clients, mounts it with NFSv3, confirms root is not squashed by planting a root-owned SUID bash binary, and documents a critical finding with remediation guidance.

Quick Start

Enumerate and test the NFS service on the target host at 192.168.1.10 for export misconfigurations and UID impersonation.

Frequently Asked Questions about pentesting-nfs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate NFS exports on a target server?▼

Run showmount -e against the target to list exports and allowed clients, then use rpcinfo -p to discover RPC programs like mountd. Supplement with nmap NSE scripts nfs-ls, nfs-showmount, and nfs-statfs on port 2049 for deeper detail.

How to test NFS no_root_squash misconfiguration?▼

Mount the export with NFSv3, then copy bash to the share, set it root-owned with the SUID bit, and execute it with -p on the host. If root is not squashed, the binary runs with euid=0, confirming the misconfiguration.

What tools work for NFS penetration testing?▼

Core tools include showmount and rpcinfo for enumeration, mount -t nfs for accessing shares, nfsshell for interactive UID/GID switching, and hvs-consulting nfs-security-tooling for escape and squash detection. Metasploit's scanner/nfs/nfsmount module also automates mount discovery.

Why does showmount show nothing on an NFS server?▼

The server may be NFSv4-only, which does not use mountd or rpcbind for export listing. Mount the root path directly with mount -t nfs and browse the pseudo-filesystem from there instead.

Can NFS UID impersonation work without Kerberos?▼

Yes, without Kerberos the NFS server trusts client-supplied UID and GID values. Create a local user matching the file owner's UID, or use fuse_nfs and nfsshell to force arbitrary UID/GID values when accessing mounted files.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
5

port-scan

Identify open ports and running services using naabu, masscan, and nmap.

Community
Intermediate
blacklanternsecurityblacklanternsecurity
253

credential-cracking

Crack password hashes and encrypted files using hashcat and john.

Official
Advanced
zebbernzebbern
34

OSCP Notes

Provide OSCP preparation notes with commands for service enumeration and exploitation.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

smb-enumeration

Enumerate SMB shares, test access permissions, and detect vulnerabilities on target hosts.

Official
Advanced