How to exploit a misconfigured NFS server (Metasploitable)

[_g_s]

Hi,

It should be working normally now, please give it a try again and let us know how it goes.

Best Regards,
Ahmed.

[awer]

Thanks. Looks like the showmount part is working correctly and i can mount the box locally.
However someone has mucked about with the permission etc on the box and the SSH isn't working.

im not in front of it now but if you cat out the auth.log its says something about root having /bin/bash as its environment.

Can you recycle the box please?

[Remix]

Hey K3r0sen,

I am following all your steps and I can't seem to mount the shared directory. I keep getting this error "mount.nfs: access denied by server while mounting 10.195.2.2:/"

Please help me! Thank you very much!

[singhc00lguy]

@K3r0sen , I tried running the command: nmap -sS 10.195.2.2
and got the following response:

Host is up.
All 1000 scanned ports on 10.195.2.2 are filtered.

I'm running Kali Linux on a virtualbox image.

Can you help me with this, please?

[K3r0sen]

Someone took it down (again). Now it should be up and running.

[singhc00lguy]

Thanks. It's working now. Able to run nmap.

[singhc00lguy]

@K3r0sen , Now I'm getting the following error while mounting:
mount.nfs access denied by server while mounting 10.195.2.2:/

Is there a way to fix that? I tried searching online but nothing helped me there.

[K3r0sen]

Have you read and tried this? https://community.ctf365.com/t/first-challenge-road-blocks/1317/7?u=k3r0sen

[ewall198]

I believe that this was caused because the full command needs to be run with elevated permissions.

The following will not work:

:~/.ssh$ sudo cat ./id_rsa.pub >> /tmp/nfs/root/.ssh/authorized_keys

Where as the following will work:

:~/.ssh$ sudo bash -c "cat ./id_rsa.pub >> /tmp/nfs/root/.ssh/authorized_keys"

or this will work:

:~/.ssh$ sudo bash
:~/.ssh# cat ./id_rsa.pub >> /tmp/nfs/root/.ssh/authorized_keys

[fl4g_hunt3r.h]

10.195.2.2 down, can't scan with nmap.

[mbrescia82]

still down, right? tried with all nmap scan techniques without any result

[fl4g_hunt3r.h]

now is up, i restarted the vpn.

[mbrescia82]

thank you. i'm gonna play on it right now.

[nemr0d]

hello,

trying to follow the tutorials, and I mounted the nfs directory, appended the ssh keys to the server key, but I get this:

ssh root@10.195.2.2
ssh_exchange_identification: Connection closed by remote host

I looked around in the passwd and shadow and found some user/pass, used john the ripper. then tried ssh, and telnet, but I can't go any further.

any ideias?

[m01jd]

I'm following the first tutorial but when I'm using
.ssh/id_rsa.pub >> /tmp/nfs/root/.ssh/authorized_key

it gives me this:
.ssh/id_rsa.pub: Permission denied

What's the reason for this and how can I overcome it?
I've already searched but I didn't find answers.

[hackslash]

Is it down again ports are filtered also when i use -Pn

[K3r0sen]

I just rebuild it. Now it should be up and running.

[hackslash]

Hi,

I think it is down again.

[K3r0sen]

Try again. It's up and running.

[Cr2z1d06]

Hello,

I believe 10.194.2.2 is down

root@kali:~# ping 10.195.2.2
PING 10.195.2.2 (10.195.2.2) 56(84) bytes of data.
^C
--- 10.195.2.2 ping statistics ---
231 packets transmitted, 0 received, 100% packet loss, time 235946ms