Lion Cipher Lab
Enumerate NFS exports and abuse no_root_squash
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
NFS — the Network File System — is one of the oldest and most quietly ubiquitous ways to share a directory between UNIX and Linux machines, and it is everywhere a pentester actually goes: on-prem file servers, NAS appliances, VMware and Kubernetes storage backends, university and research clusters, and the forgotten build server in the corner. Its default trust model is astonishingly weak by modern standards — in its common sec=sys configuration, an NFS server simply believes whatever user ID the connecting client claims to be, with no authentication of the machine or the user at all. Layered…
What you'll learn
- defining NFS, an export, /etc/exports, and root-squashing in plain language before touching a command
- discovering NFS exports three ways: showmount -e, rpcinfo, and nmap's nfs-showmount / nfs-ls / nfs-statfs NSE scripts
- understanding NFS's AUTH_SYS (sec=sys) trust model and why it is the root cause of this whole class of bug
- mounting an export and reading the numeric uid a file lands as, to SEE squashing happen or not happen
- abusing no_root_squash by planting a SUID-root binary from a box where you are root, then executing it on the server for a root shell
- fixing the export with root_squash and a host allow-list, re-exporting, and re-testing to prove the exploit is now blocked
- judgment: when you meet NFS in the wild, when it is still the right tool, and the professional fix (root_squash + NFSv4/Kerberos sec=krb5 + network isolation) rather than a one-flag patch
Steps in this lab
- The words this lab rests on: NFS, an export, and squashing
- Build the vulnerable server — and yes, you must deliberately break it
- Scope — this is a lab network, and only a lab network
- Discover the export — showmount, rpcinfo, and nmap's NFS scripts
- Mount the export
- Abuse no_root_squash — plant a SUID-root binary, get a root shell
- Fix it and re-test — root_squash plus a host allow-list
- The judgment: why it really broke, and the fix beyond one flag
- Do it better — the habits, and what to carry out of this lab