Skip to content
HackIndex logo

HackIndex

Mounted Filesystems and Storage Enumeration on Linux

3 min read Mar 15, 2026

Filesystem enumeration reveals what storage is attached to the host, where it is mounted, and crucially — what is present but not mounted. Unmounted partitions can contain sensitive data or lead directly to privilege escalation. Network mounts expose trust relationships with other hosts.

Currently Mounted Filesystems

┌──(kali㉿kali)-[~]
└─$ mount | column -t
┌──(kali㉿kali)-[~]
└─$ df -h
┌──(kali㉿kali)-[~]
└─$ cat /proc/mounts 
sysfs       on  /sys              type  sysfs    (rw,nosuid,nodev,noexec,relatime)
proc        on  /proc             type  proc     (rw,nosuid,nodev,noexec,relatime)
/dev/sda1   on  /                 type  ext4     (rw,relatime,errors=remount-ro)
/dev/sda2   on  /home             type  ext4     (rw,relatime)
tmpfs       on  /run/user/1000    type  tmpfs    (rw,nosuid,nodev,relatime)
10.10.10.5:/exports on /mnt/share type  nfs      (rw,relatime,vers=3)

Look for:

  • NFS or SMB mounts — these reveal trust relationships with other hosts and may be misconfigured. NFS-specific exploitation is covered under the NFS service pages.

  • Separate partitions for /home, /var, /tmp — these may have different permissions or contain data isolated from the root partition

  • nosuid and noexec mount options — binaries placed on these filesystems cannot be executed or run with SUID, which affects your staging choices

fstab — Persistent Mount Configuration

┌──(kali㉿kali)-[~]
└─$ cat /etc/fstab

/etc/fstab shows all mounts configured to persist across reboots, including ones that are not currently mounted. This reveals:

  • Unmounted partitions with their device paths — mount them manually to inspect

  • NFS shares and the remote hosts they come from

  • Credentials embedded in mount options for CIFS/SMB mounts — username=, password=, credentials= entries

┌──(kali㉿kali)-[~]
└─$ //10.10.10.20/share /mnt/backup cifs username=svc_backup,password=Summer2023!,uid=0 0 0

Credentials in fstab are readable by any user who can read the file, which is typically everyone.

Block Devices and Unmounted Partitions

┌──(kali㉿kali)-[~]
└─$ lsblk
┌──(kali㉿kali)-[~]
└─$ lsblk -f 
NAME   FSTYPE  LABEL  UUID                                  MOUNTPOINT
sda
├─sda1 ext4           a1b2c3d4-...                          /
├─sda2 ext4           e5f6a7b8-...                          /home
└─sda3 ext4           c9d0e1f2-...
sdb    ext4           12345678-...

sda3 and sdb have filesystems but no mountpoint — they are unmounted. Mounting and inspecting them is covered in Unmounted Filesystem Privilege Escalation.

Disk Group and Raw Device Access

┌──(kali㉿kali)-[~]
└─$ ls -la /dev/sd* /dev/vd* /dev/nvme* 2>/dev/null

If you are a member of the disk group, you can read raw block devices directly without mounting:

┌──(kali㉿kali)-[~]
└─$ id | grep disk

Disk group membership is a privilege escalation path covered in Group-Based Privilege Escalation on Linux.

Temporary and Shared Memory Filesystems

┌──(kali㉿kali)-[~]
└─$ ls -la /tmp /var/tmp /dev/shm

These are writable by all users and survive across sessions in some cases. /dev/shm is memory-backed and leaves no disk traces — preferred for staging payloads and exploit binaries. /var/tmp persists across reboots where /tmp may not.

Check for files left by other users or processes:

┌──(kali㉿kali)-[~]
└─$ ls -lat /tmp /var/tmp /dev/shm 2>/dev/null

Files owned by root or other users in these directories sometimes contain temporary credentials, sockets, or scripts worth reviewing.

World-Readable Sensitive Directories

┌──(kali㉿kali)-[~]
└─$ ls -la /var/backups/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la /var/log/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la /opt/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la /srv/ 2>/dev/null

/var/backups/ on Debian-based systems sometimes contains a readable copy of /etc/shadow.bak or /etc/passwd.bak. /opt/ commonly holds third-party applications with their own config files and credentials.