# Mounted Filesystems and Storage Enumeration on Linux

> Enumerate mounted filesystems, storage devices, and disk configurations on Linux to identify sensitive data locations, misconfigurations, and privilege escalation paths.

- **URL:** https://hackindex.io/platforms/linux/enumeration/mounted-filesystems-and-storage
- **Path:** Linux > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/linux/enumeration.md)
- **Published:** 2026-03-15
- **Updated:** 2026-08-11

Filesystem enumeration reveals what storage is attached to the host, where it is mounted, and crucially: what is present but not mounted. Unmounted partitions can contain sensitive data or lead directly to privilege escalation. Network mounts expose trust relationships with other hosts.

## Enumerating Currently Mounted Linux Filesystems

```bash
mount | column -t
df -h
cat /proc/mounts
# sysfs       on  /sys              type  sysfs    (rw,nosuid,nodev,noexec,relatime)
# proc        on  /proc             type  proc     (rw,nosuid,nodev,noexec,relatime)
# /dev/sda1   on  /                 type  ext4     (rw,relatime,errors=remount-ro)
# /dev/sda2   on  /home             type  ext4     (rw,relatime)
# tmpfs       on  /run/user/1000    type  tmpfs    (rw,nosuid,nodev,relatime)
# 10.10.10.5:/exports on /mnt/share type  nfs      (rw,relatime,vers=3)
```

Look for:

- NFS or SMB mounts: these reveal trust relationships with other hosts and may be misconfigured. NFS-specific exploitation is covered under the NFS service pages.
- Separate partitions for `/home`, `/var`, `/tmp`: these may have different permissions or contain data isolated from the root partition
- `nosuid` and `noexec` mount options: binaries placed on these filesystems cannot be executed or run with SUID, which affects your staging choices

## fstab: Persistent Mount Configuration

```bash
cat /etc/fstab
```

`/etc/fstab` shows all mounts configured to persist across reboots, including ones that are not currently mounted. This reveals:

- Unmounted partitions with their device paths: mount them manually to inspect
- NFS shares and the remote hosts they come from
- Credentials embedded in mount options for CIFS/SMB mounts: `username=`, `password=`, `credentials=` entries

```bash
//10.10.10.20/share  /mnt/backup  cifs  username=svc_backup,password=Summer2023!,uid=0  0  0
```

Credentials in fstab are readable by any user who can read the file, which is typically everyone.

## Block Devices and Unmounted Partitions

```bash
lsblk
lsblk -f
# NAME   FSTYPE  LABEL  UUID                                  MOUNTPOINT
# sda
# ├─sda1 ext4           a1b2c3d4-...                          /
# ├─sda2 ext4           e5f6a7b8-...                          /home
# └─sda3 ext4           c9d0e1f2-...
# sdb    ext4           12345678-...
```

`sda3` and `sdb` have filesystems but no mountpoint: they are unmounted. Mounting and inspecting them is covered in [Unmounted Filesystem Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/unmounted-filesystem-privilege-escalation).

## Disk Group and Raw Device Access

```bash
ls -la /dev/sd* /dev/vd* /dev/nvme* 2>/dev/null
```

If you are a member of the `disk` group, you can read raw block devices directly without mounting:

```bash
id | grep disk
```

Disk group membership is a privilege escalation path covered in [Group-Based Privilege Escalation on Linux](https://hackindex.io/platforms/linux/privilege-escalation/group-based-privilege-escalation).

## Temporary and Shared Memory Filesystems

```bash
ls -la /tmp /var/tmp /dev/shm
```

These are writable by all users and survive across sessions in some cases. `/dev/shm` is memory-backed and leaves no disk traces: preferred for staging payloads and exploit binaries. `/var/tmp` persists across reboots where `/tmp` may not.

Check for files left by other users or processes:

```bash
ls -lat /tmp /var/tmp /dev/shm 2>/dev/null
```

Files owned by root or other users in these directories sometimes contain temporary credentials, sockets, or scripts worth reviewing.

## World-Readable Sensitive Directories

```bash
ls -la /var/backups/ 2>/dev/null
ls -la /var/log/ 2>/dev/null
ls -la /opt/ 2>/dev/null
ls -la /srv/ 2>/dev/null
```

`/var/backups/` on Debian-based systems sometimes contains a readable copy of `/etc/shadow.bak` or `/etc/passwd.bak`. `/opt/` commonly holds third-party applications with their own config files and credentials.