Reconnaissance with Nmap Scripting Engine

In this previous topic, we have seen how Nmap can be used to perform port scanning against a given target.
Of course, this is just one of the capabilities of this great tool. In fact, another very useful feature is represented by Nmap Scripting Engine (NSE).

NSE allows to include scripts, coded with Lua programming language, inside Nmap and run them to perform networking tasks in an autonomous way: this includes discovery, version detection, vulnerability discovery and even exploitation.

This is the reason why there are different categories for the scripts inside the engine: auth, broadcast, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, and vuln. For a description of each one, take a look here.

It is possible to check the complete scripts list here. If you are using Kali Linux, the scripts folder is located at /usr/share/nmap/scripts and scripts have the extension “.nse”.
In order to update scripts database, we can just run nmap --script-updatedb.

As the help section reports, to run the engine with a predefined number of scripts, the parameter to use is “-sC”:

root@kali:~# nmap -h

  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or

This will execute all the scripts included in the “default” category against the specified target. It is recommended to use this option with caution, since some of the scripts included in the default category might be particularly intrusive.

Instead of launching the engine using a particular category, we can run a single script by using the --script parameter. This can be done, for example, after a previous scan where we detected an active service on some port that might be of interest.

Since the best way to understand how a tool works is to practice with it, we will see an example of NSE capabilities using a laboratory environment composed by an attacking Kali Linux machine and a vulnerable target, Metaspoitable 2 VM.

Metasploitable 2: NFS misconfiguration

Considering the results of the Nmap scan performed on the target in this article, we can take a look at the following services:

111/tcp  open  rpcbind
2049/tcp open  nfs

NFS means Network File System: this protocol allows, through Remote Procedure Calls (RPC), to share portion of file systems over a computer network. Since this machine is intentionally vulnerable, the service has been misconfigured on purpose and we can use NSE to detect the misconfiguration.

The script we are interested in is nfs-ls in the “discovery safe” category; to display the description we just use --script-help followed by the name of the script:

root@kali:~# nmap --script-help nfs-ls

Starting Nmap 7.40 ( ) at 2017-02-18 19:30 CET

Categories: discovery safe
  Attempts to get useful information about files from NFS exports.
  The output is intended to resemble the output of <code>ls</code>.

  The script starts by enumerating and mounting the remote NFS exports. After
  that it performs an NFS GETATTR procedure call for each mounted point
  in order to get its ACLs.
  For each mounted directory the script will try to list its file entries
  with their attributes.

  Since the file attributes shown in the results are the result of
  GETATTR, READDIRPLUS, and similar procedures, the attributes
  are the attributes of the local filesystem.

  These access permissions are shown only with NFSv3:
  * Read:     Read data from file or read a directory.
  * Lookup:   Look up a name in a directory
              (no meaning for non-directory objects).
  * Modify:   Rewrite existing file data or modify existing
              directory entries.
  * Extend:   Write new data or add directory entries.
  * Delete:   Delete an existing directory entry.
  * Execute:  Execute file (no meaning for a directory).

  Recursive listing is not implemented.

The target has IP address (discovered, for example, using Netdiscover or Nmap itself), so we can start running the NFS discovery script against the machine.
In order to trigger as less alerts as possible, it is always a good idea to scan only ports we are focusing on. The port we are interested in is not the one on which runs the NFS service, but the “rpcbind” one: this service performs the task of routing requests between clients and NFS server.
Then, we can launch Nmap against port 111:

root@kali:~# nmap -p 111 --script=nfs-ls

Starting Nmap 7.40 ( ) at 2017-02-19 09:14 CET
Nmap scan report for metasploitable2 (
Host is up (0.00012s latency).
111/tcp open  rpcbind
| nfs-ls: Volume /
|   access: Read Lookup Modify Extend Delete NoExecute
| -rwx------  0    0    134    2016-02-27T18:28:03  .7RSS8eUhMslnW9Zc
| drwxr-xr-x  0    0    4096   2012-05-14T03:35:33  bin
| drwxr-xr-x  0    0    4096   2016-03-06T13:45:42  home
| drwxr-xr-x  0    0    4096   2010-03-16T22:57:40  initrd
| lrwxrwxrwx  0    0    32     2010-04-28T20:26:18  initrd.img
| drwxr-xr-x  0    0    4096   2012-05-14T03:35:22  lib
| drwx------  0    0    16384  2010-03-16T22:55:15  lost+found
| drwxr-xr-x  0    0    4096   2010-03-16T22:55:52  media
| drwxr-xr-x  0    0    4096   2010-04-28T20:16:56  mnt
| drwxr-xr-x  0    0    4096   2012-05-14T01:54:53  sbin
MAC Address: 00:0C:29:59:72:BC (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.43 seconds

As the outputs reports, we have the directory listing, with details about permissions, for the NFS share; the mounting point is the root directory “/” (nfs-ls: Volume /).
This can be confirmed with a command for showing mount points:

root@kali:~# showmount -e
Export list for
/ *

This shows a really bad configuration: NFS service is useful to share portions of the file system to predefined users or groups, but if it is not configured properly it can turn into a huge security risk like in this case where anyone can access the root directory remotely.

To verify the possibility to mount the volume, we can create a temporary directory and try to mount Metasploitable 2 root directory on it:

root@kali:~# mkdir /tmp/nfs

root@kali:~# mount -o nolock -t nfs /tmp/nfs

root@kali:~# ls -l /tmp/nfs/
total 160
drwxr-xr-x  2 root root  4096 May 14  2012 bin
drwxr-xr-x  3 root root  4096 Apr 28  2010 boot
lrwxrwxrwx  1 root root    11 Apr 28  2010 cdrom -> media/cdrom
drwxr-xr-x  2 root root  4096 May 20  2012 dev
drwxr-xr-x 95 root root  4096 Feb 19 09:01 etc
drwxr-xr-x  6 root root  4096 Mar  6  2016 home
drwxr-xr-x  2 root root  4096 Mar 16  2010 initrd
lrwxrwxrwx  1 root root    32 Apr 28  2010 initrd.img -> boot/initrd.img-2.6.24-16-server
drwxr-xr-x 13 root root  4096 May 14  2012 lib
drwx------  2 root root 16384 Mar 16  2010 lost+found
drwxr-xr-x  4 root root  4096 Mar 16  2010 media
drwxr-xr-x  3 root root  4096 Apr 28  2010 mnt
-rw-------  1 root root 65699 Feb 19 09:01 nohup.out
drwxr-xr-x  2 root root  4096 Mar  6  2016 opt
dr-xr-xr-x  2 root root  4096 Apr 28  2010 proc
drwxr-xr-x 13 root root  4096 Feb 19 09:01 root
drwxr-xr-x  2 root root  4096 May 14  2012 sbin
drwxr-xr-x  2 root root  4096 Mar 16  2010 srv
drwxr-xr-x  2 root root  4096 Apr 28  2010 sys
drwxrwxrwt  4 root root  4096 Feb 19 09:01 tmp
drwxr-xr-x 12 root root  4096 Apr 28  2010 usr
drwxr-xr-x 15 root root  4096 May 20  2012 var
lrwxrwxrwx  1 root root    29 Apr 28  2010 vmlinuz -> boot/vmlinuz-2.6.24-16-server

“ls -l” shows the mount operation has been executed successfully. Now, we can read or write files in the compromised machine.
Once we have done with it, we can unmount the volume with:

root@kali:~# umount /tmp/nfs


In this article we have seen how NSE can be used to discover useful information about the target system. Of course, this is just a simple example to give an idea of what you can do with the engine. Since everyone can contribute to the scripts, this project has a lot of potential because you can write your own code and run it in Nmap.
Take your time to practice with this powerful tool taking also a look at the other scripts categories.