Skip to content

NFSv4 Support - #1383

Draft
NeffIsBack wants to merge 4 commits into
mainfrom
nfsv4
Draft

NFSv4 Support#1383
NeffIsBack wants to merge 4 commits into
mainfrom
nfsv4

Conversation

@NeffIsBack

@NeffIsBack NeffIsBack commented Sep 1, 2026

Copy link
Copy Markdown
Member

Description

This PR will add all flavors of NFSv4 (4.0, 4.1, 4.2) including authentication that is specified in the respective RFCs such as Kerberos auth to NetExec. The raw NFS client will be implemented by the library itself with the following PR: Pennyw0rth/NfsClient#5

So far it works, and that's beautiful, okay?! The code is pretty bad so far, but I will improve it when the library is finished and fix the bugs that exist at the moment (no idea why it says "root escape:unknown" and then successfully lists the entire file system lol).

The RFCs that NFS 4.0, 4.1 and 4.2 are based on were implemented by codex sol on ultra with my guidance:

Protocol Protocol specification XDR specification
NFSv4.0 RFC 7530 RFC 7531
NFSv4.1 RFC 8881 RFC 5662
NFSv4.2 RFC 7862 RFC 7863

The implementation in NetExec was also done by AI so far, but that will change once I clean up the implementation and fix the logic.

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Deprecation of feature or functionality
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)
  • This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

  1. Install the nfs server: sudo apt install nfs-kernel-server`
  2. Define an export in /etc/exports pointing to an existing folder, e.g.: /var/nfs/general *()
  3. Run nxc nfs localhost (or the appropriate target)

For a Kerberos setup you have to ask AI, because setting up a KDC etc. on Linux is quite complicated.

Don't be scare by the amount of added lines, +500 are just tests...

Screenshots (if appropriate):

image

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

  • I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
  • I have performed a self-review of my own code (not an AI review)
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

@NeffIsBack NeffIsBack added enhancement New feature or request AI slop PRs created with the help of or fully by AI labels Sep 1, 2026
Comment thread nxc/protocols/nfs.py
def print_host_info(self):
root_escape_str = colored(f"root escape:{self.root_escape}", host_info_colors[1 if self.root_escape else 0], attrs=["bold"])
self.logger.display(f"Supported NFS versions: ({', '.join(str(x) for x in self.nfs_versions)}) ({root_escape_str})")
def plaintext_login(self, domain, username, password):
protocol = make_protocol("4.2", share="/export")
protocol.nfs = SimpleNamespace(
root_handle=lambda share: {"status": 0, "mountinfo": {"fhandle": b"root"}},
status_name=lambda status: str(status),
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AI slop PRs created with the help of or fully by AI enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant