metasploit-cursor-harness: Skill for Cursor

NFS Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Linux targets: load linux-pentest.

Ports and detection

Port	Service
2049/tcp, 2049/udp	NFS (RPC #100003)
111/tcp, 111/udp	portmapper/rpcbind

RPC and export enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/nfs/nfsmount",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 2049, "PATH": "/"}
)

CLI fallback:

rpcinfo -p <target>
showmount -e <target>
nmap --script nfs-showmount,nfs-ls,nfs-statfs -p 2049 <target>
nmap -p111,2049 --script rpcinfo <target>

NFSv4 may not respond to showmount; try direct mount of /.

Workflow

Task Progress:
- [ ] rpcinfo and export enumeration
- [ ] Mount and permission testing
- [ ] UID/GID spoofing (nfsshell/fuse_nfs)
- [ ] no_root_squash testing
- [ ] NFSv4 Kerberos check
- [ ] Document findings

Export listing

MSF: No direct showmount module; use nfsmount or CLI.

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/nfs/nfsmount",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 2049, "PATH": "/export"}
)

CLI fallback:

showmount -e <target>
nmap --script nfs-showmount -p 2049 <target>
exportfs -v   # from compromised server

rpcinfo broader enum

MSF: No direct module; use CLI.

CLI fallback:

rpcinfo -p <target>
rpcinfo -p <target> | grep -E 'nfs|mount|nlock'
nmap -p111 --script rpcinfo <target>
# Enumerate all RPC services
for prog in $(rpcinfo -p <target> | awk '{print $1}' | sort -u); do
  rpcinfo -p <target> | grep "$prog"
done

Standard mount

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/nfs/nfsmount",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "PATH": "/export", "MOUNTPOINT": "/mnt/nfs"}
)

CLI fallback:

mkdir /mnt/nfs
mount -t nfs -o vers=3,nolock <target>:/export /mnt/nfs
mount -t nfs -o vers=2,nolock <target>:/backup /mnt/nfs
nfs-ls <target>:/export