OBJECTIVE

NFS (network file system) is a file system that enables file sharing between computers of different operating systems (Windows/Linux/Mac).

In this practice box from TryHackMe, we will hack into NFS and exploit a misconfiguration (No-root Squash) to obtain root access and find our final root.txt flag.

WHAT IS NO-ROOT SQUASH?

No-root Squash is an uncommon configuration (some might say a misconfiguration) on the NFS file system.

When enabled, it allows remote users to change file permissions on any file and also to add a SETUID bit to effectively run programs as the root user. Normally it is disabled to protect against hackers, and all root-created files are assigned to an unprivileged owner named nfsnobody.

Recommended: If you are interested in learning more technical details about how this works, I’d recommend this article on no_root_squash and other configuration options when using NFS.

ENUMERATION

We’ll start with a standard Nmap scan of all ports with the -p- flag:

nmap $targetIP -p-

The scan shows an nfs service running on port. Let’s find out what directories are mountable with the command:

showmount -e $targetIP

(-e for exports)

Let’s go ahead and mount the /home directory to our target machine. I’m using Parrot OS virtual machine with a Mate desktop environment running in Gnome Boxes. We can mount the nfs directory directly to our local filesystem with the command:

mount -t nfs $targetIP:/home /mount

(-t indicates filetype) 

And now we can continue further enumeration by poking around the filesystem.

cd /mount

ls -la

We find a user folder in the home directory, cappuccino and a hidden directory .ssh. Inside the directory there is an id_rsa file that holds a private ssh key.

INITIAL FOOTHOLD – USER CAPPUCCINO 

After copying the id_rsa over to our target machine, we can ssh into cappuccino’s account with this command:

ssh -i id_rsa cappuccino@$targetIP

ENUMERATING PRIVILEGE ESCALATION ATTACK VECTORS WITH LINPEAS

Now that we have our initial foothold, we can grab a copy of the well-known script linpeas.sh from the official git repo and use it to automate the enumeration of attack vectors for privilege escalation on the target machine. We’ll navigate to the /mount folder and use the command wget on our attack machine for this:

sudo wget https://github.com/carlospolop/PEASS-ng/...linpeas.sh 

Before running the sh program from our target machine, we need to add execute permissions to the file from our attack machine.

The beauty of mounting NFS file systems in Linux is evident here as we can easily add permissions to linpeas.sh from our attack machine to set up the program to be executable on the target machine.

chmod +x linpeas.sh

Now that linpeas.sh is located in the /home folder of the target machine, we can run it to start the automated enumeration:

./linpeas.sh

This will dump a long text file full of details about the target machine. The most interesting things for privilege escalation are highlighted in yellow with red text.

Scrolling through the results, we quickly find the no_root_squash listed under NFS. We will now move forward and exploit this misconfiguration, allowing us to escalate privileges to the root user.

EXPLOITING NO_ROOT_SQUASH

First, let’s grab the bash executable for Ubuntu Server 18.04 from the link on TryHackMe.

Sudo wget https://github.com/TheRealPoloMints/Blog...s%202/bash

Now we add the SETUID bit to the file bash and make it executable. This is the key to gaining root access with no_root_squash.

sudo chmod +sx bash

Running bash now from our target machine doesn’t seem to change us to the root user yet.

./bash

The final trick we need to use is to enable persistence mode with the flag -p

If you liked this tutorial, you’d probably love my video walkthrough as well:

Recommended Tutorial: Alice in Wonderland — TryHackMe

As a parent, planning for your children’s future is one of the most important things you can do.

To ensure they have the best possible start in life, I’ve been looking into ways to invest money to provide them with a lump sum of $70k when they reach 21. But I don’t want to spend that much money at once when they turn 21.

So what to do?

In this blog post, I’ll be exploring how Python helped me figure out a simple investment plan, so I can give my kids a nice nest egg without needing to spend a lot of our (parents’) money at once.

Result: I need to set up a savings plan contributing $90 per month for 21 years in a vehicle earning 9% per year (e.g., S&P500 ETF), so my kids get a $70k nest egg when they start into their own lives.

Here’s the Python code — I’ll explain it in a moment:

import matplotlib.pyplot as plt

import numpy as np # Define initial investment value, investment return, and monthly contributions

initial_investment = 1000

investment_return = 0.09

monthly_contributions = [30,60,90]

num_years = 21 # Create list of portfolio values over time for each savings rate

portfolio_values = []

for contribution in monthly_contributions: portfolio = [initial_investment] portfolio_value = initial_investment for i in range(1,num_years-1): portfolio_value = portfolio_value * (1 + investment_return) + contribution * 12 portfolio.append(portfolio_value) portfolio_values.append(portfolio) # Plot portfolio values over time

time = np.arange(1,num_years)

for i in range(len(monthly_contributions)): plt.plot(time, portfolio_values[i], label='$' + str(monthly_contributions[i]) + '/m')

plt.title('Portfolio Value over Time')

plt.xlabel('Time (years)')

plt.ylabel('Portfolio Value ($)') # Add end value labels

for i in range(len(monthly_contributions)): plt.text(num_years-3, portfolio_values[i][-1], '$' + str(int(portfolio_values[i][-1]*1.3))) plt.legend()

plt.show()

Result:

This code snippet plots the value of a portfolio for different monthly contributions over a period of 21 years.

You specify the

• initial investment value,
• investment return,
• number of years, and
• monthly contributions.

Then, you create a list to store the portfolio values over time for each monthly contribution.

You calculate the portfolio values by multiplying the previous value of the portfolio by the investment return plus the contribution for each month. You repeat this calculation over the number of years minus one, taking the initial investment into account.

You use Matplotlib to plot the portfolio values. The x-axis is the time in years and the y-axis is the portfolio value in dollars.

Recommended Tutorial: A Video Guide on Matplotlib

You add a title and labels to the plot. You also add the end value for each of the portfolios to the plot with a text label. Finally, you display the plot.

Action Steps

• Copy the code into your own Python script.
• Figure out your (base) investment goals for your kids or yourself. What do you need to accomplish? What would be your dream outcome?
• Change the input values until you’re happy with your results.

You can check out our Finxter Academy course on Matplotlib to learn all you need to use plotting and data visualization in Python.

This is part of our 100 practical Python projects series. Subscribe here.