NfSpy meets the real world

Recently, Rob Fuller a.k.a. mubix posted a how-to for using NfSpy through a Meterpreter pivot. It's always nice to see your tools being used in the real world, and mubix's writeup was detailed and straightforward. It was clear, however, that NfSpy is not as user-friendly as I had hoped. I'll try to address some shortfalls in this post, which may also serve as a roadmap for further development.

Disable NFSv2 on Debian/Ubuntu

These instructions apply to the nfs-kernel-server package on Ubuntu 10.04 LTS and 12.04 LTS, and probably apply to various Debian versions as well.

The kernel NFS server is called rpc.nfsd, so its options are documented in the rpc.nfsd(8) man page. To turn off specific versions of NFS, pass the -N or --no-nfs-version argument to this daemon, as well as the rpc.mountd daemon. The accepted config file to do this is /etc/default/nfs-kernel-server.

For Ubuntu 12.04, there is a rather obviously-named variable, RPCNFSDARGS, that can be set to pass arguments to rpc.nfsd. Here's one for turning off NFSv2:

RPCNFSDARGS="-N 2"

On Ubuntu 10.04, there is no such variable, and creating it does nothing, since the init script (/etc/init.d/nfs-kernel-server) does not reference it. Instead, the RPCNFSDCOUNT variable can be used, since it is passed to the rpc.nfsd as well. Here's how to do the same thing on 10.04:

RPCNFSDCOUNT="-N 2 8"

Remember to keep the "8" (or whatever you choose to set it to).

For both versions, setting the RPCMOUNTDOPTS variable the same way is recommended, so that clients don't mount the wrong version of your exports:

RPCMOUNTDOPTS="-N 2 --manage-gids"