A misconfiguration chain that gave me root on a lab box — without a single credential. Last week I worked…
Luís W. — Pesquisador de Segurança / Bug Bounty
A misconfiguration chain that gave me root on a lab box — without a single credential.
Last week I worked through an NFS + rsync chain in my offensive security lab. The technique is straight out of a real Bug Bounty playbook.
The target had:
• NFSv3 exported to * (any host) • rsync 873/tcp running as root, read/write, no authentication
Each one alone? Manageable. Combined? Full RCE as root + privilege escalation on the NFS client.
The chain:
1️⃣ showmount -e → NFS exported to anyone. 2️⃣ rsync rsync://target/ → the "backup" module was the entire filesystem, writable, running as root. 3️⃣ Drop a cron job into /var/spool/cron/crontabs/root via rsync → RCE as root in 60 seconds. 4️⃣ Plant a SUID-root /bin/bash inside the NFS share → any unprivileged user on the NFS client becomes root.
Lessons I'm taking into my Bug Bounty workflow:
→ Misconfigurations chain. The most devastating findings aren't always exotic 0-days — they're three "small" mistakes lined up next to each other.
→ root_squash is not a security boundary if anything else on the same host can write as root.
→ Always enumerate adjacent services. The NFS port wasn't the vulnerability. The rsync daemon next to it was.
→ "Read-only" or "harmless" services like rsync, NFS, SMB and FTP are still attack surface when permissions and configs aren't tight.
If you hunt in private programs with internal scope or VPN-accessible assets, this pattern shows up more often than you'd think.
What's the most impactful misconfig chain you've ever exploited?
#BugBounty #Cybersecurity #Pentest #InfoSec #EthicalHacking #OffensiveSecurity #RedTeam #NFS #Linux #SecurityResearch
4 reactions · 1 comments
Topics: #bugbounty, #offensivesecurity, #ethicalhacking, #nfs, #infosec, #securityresearch, #redteam, #pentest, #cybersecurity, #linux
Comments
Damian K.: Świetny przykład tego, jak „niewinne” błędne konfiguracje zamieniają się w pełny attack chain. I właśnie dlatego klasyczne podejście: → „znajdź CVE” → „załatane = bezpieczne” coraz częściej przegrywa z rzeczywistością. W RedNode coraz mocniej skupiam się właśnie na: → runtime correlation → attack-chain cognition → trust propagation → topology-aware reasoning → misconfiguration chaining Bo w prakty