strongwind1/nfswolf

How strongwind1/nfswolf works

NFSWolf is a native NFS security toolkit. Its principal workflow discovers NFS hosts, analyzes exports for security findings, and presents results; separate command paths support export escape, handle and UID attacks, an interactive shell, and FUSE mounting. Protocol clients cover NFSv2/v3/v4, while a shared transport layer supplies connection policy. The README documents capabilities that are not fully visible in the sampled source; those links are marked as unverified rather than inferred as direct calls.

Main entry points: escape.rs Escape Command · main.rs CLI Runtime · analyze.rs Export Audit · transport.rs Pooled Transport

Components 26

Command Workflows

CLI Runtime src/main.rs
Host Scan src/cli/scan.rs
Export Audit src/cli/analyze.rs
Escape Command src/cli/escape.rs
Shell Command src/cli/shell.rs
Mount Command src/cli/mount.rs
Handle Sweep src/cli/brute_handle.rs
UID Spray src/cli/uid_spray.rs

Security Engines

Scanner src/engine/scanner.rs
Analysis Engine src/engine/analyzer.rs
Escape Engine src/engine/escape.rs
Handle Oracle src/engine/file_handle.rs

NFS Access

Interactive Shell src/shell/mod.rs
FUSE Mount src/fuse.rs
NFSv2 Client crates/nfs-v2/src/client.rs
NFSv3 Client crates/nfs-v3/src/api/ops.rs
NFSv4 Client crates/nfs-v4/src/client.rs
MOUNT Protocol src/proto/mount.rs

RPC Infrastructure

Pooled Transport src/proto/transport.rs
RPC Connection src/proto/conn.rs
Credentials src/proto/auth.rs
Portmapper src/proto/portmap.rs

Results

Report Renderers src/report/mod.rs
Output Formats src/output.rs
Report Conversion src/cli/convert.rs

Other components

Operator

Connections 30

Operator → Host Scan: scans hosts
Operator → Export Audit: audits export
Operator → Escape Command: requests escape
Operator → Shell Command: opens shell
Operator → Mount Command: mounts export
Operator → Handle Sweep: sweeps handles
Operator → UID Spray: sprays credentials
CLI Runtime → Host Scan: dispatches src/main.rs
CLI Runtime → Export Audit: dispatches src/main.rs
CLI Runtime → Escape Command: dispatches src/main.rs
CLI Runtime → Shell Command: dispatches src/main.rs
Host Scan → Scanner: runs discovery
Export Audit → Analysis Engine: runs audit
Escape Command → Escape Engine: uses engine src/cli/escape.rs
Escape Command → Handle Oracle: uses oracle src/cli/escape.rs
Escape Command → NFSv3 Client: probes exports src/cli/escape.rs
Escape Command → NFSv2 Client: probes exports src/cli/escape.rs
Escape Command → NFSv4 Client: probes exports src/cli/escape.rs
Shell Command → Interactive Shell: starts REPL
Mount Command → FUSE Mount: starts mount
Analysis Engine → NFSv4 Client: issues compounds src/engine/analyzer.rs
NFSv3 Client → Pooled Transport: uses transport
NFSv4 Client → Pooled Transport: uses transport
Pooled Transport → RPC Connection: checks out sessions src/proto/transport.rs
Pooled Transport → Credentials: encodes identity src/proto/transport.rs
RPC Connection → MOUNT Protocol: mounts export src/proto/conn.rs
RPC Connection → Portmapper: queries service port src/proto/conn.rs
Export Audit → Report Renderers: produces findings
Report Conversion → Report Renderers: renders formats src/cli/convert.rs
Report Conversion → Output Formats: writes output src/cli/convert.rs

More Rust diagrams: oxidecomputer/buildomat · seismicsystems/summit · sparticle62ops/pssa · vihdzp/miratope-rs · anthonyhfm/launchpad-core-firmware

Drawn by GitDiagram on September 29, 2026 from the repository's file tree, README and source files. Read as Markdown ·