Skip to content
HackIndex.io

Mounted Filesystems and Storage Enumeration on Linux

3 min read Created Mar 15, 2026 Last updated Aug 11, 2026

Filesystem enumeration reveals what storage is attached to the host, where it is mounted, and crucially: what is present but not mounted. Unmounted partitions can contain sensitive data or lead directly to privilege escalation. Network mounts expose trust relationships with other hosts.

Enumerating Currently Mounted Linux Filesystems

┌──(kali㉿kali)-[~]
└─$ mount | column -t
┌──(kali㉿kali)-[~]
└─$ df -h
┌──(kali㉿kali)-[~]
└─$ cat /proc/mounts 
sysfs       on  /sys              type  sysfs    (rw,nosuid,nodev,noexec,relatime)
proc        on  /proc             type  proc     (rw,nosuid,nodev,noexec,relatime)
/dev/sda1   on  /                 type  ext4     (rw,relatime,errors=remount-ro)
/dev/sda2   on  /home             type  ext4     (rw,relatime)
tmpfs       on  /run/user/1000    type  tmpfs    (rw,nosuid,nodev,relatime)
10.10.10.5:/exports on /mnt/share type  nfs      (rw,relatime,vers=3)

Look for:

  • NFS or SMB mounts: these reveal trust relationships with other hosts and may be misconfigured. NFS-specific exploitation is covered under the NFS service pages.

  • Separate partitions for /home, /var, /tmp: these may have different permissions or contain data isolated from the root partition

  • nosuid and noexec mount options: binaries placed on these filesystems cannot be executed or run with SUID, which affects your staging choices

fstab: Persistent Mount Configuration

┌──(kali㉿kali)-[~]
└─$ cat /etc/fstab

/etc/fstab shows all mounts configured to persist across reboots, including ones that are not currently mounted. This reveals:

  • Unmounted partitions with their device paths: mount them manually to inspect

  • NFS shares and the remote hosts they come from

  • Credentials embedded in mount options for CIFS/SMB mounts: username=, password=, credentials= entries

┌──(kali㉿kali)-[~]
└─$ //10.10.10.20/share /mnt/backup cifs username=svc_backup,password=Summer2023!,uid=0 0 0

Credentials in fstab are readable by any user who can read the file, which is typically everyone.

Block Devices and Unmounted Partitions

┌──(kali㉿kali)-[~]
└─$ lsblk
┌──(kali㉿kali)-[~]
└─$ lsblk -f 
NAME   FSTYPE  LABEL  UUID                                  MOUNTPOINT
sda
├─sda1 ext4           a1b2c3d4-...                          /
├─sda2 ext4           e5f6a7b8-...                          /home
└─sda3 ext4           c9d0e1f2-...
sdb    ext4           12345678-...

sda3 and sdb have filesystems but no mountpoint: they are unmounted. Mounting and inspecting them is covered in Unmounted Filesystem Privilege Escalation.

Disk Group and Raw Device Access

┌──(kali㉿kali)-[~]
└─$ ls -la /dev/sd* /dev/vd* /dev/nvme* 2>/dev/null

If you are a member of the disk group, you can read raw block devices directly without mounting:

┌──(kali㉿kali)-[~]
└─$ id | grep disk

Disk group membership is a privilege escalation path covered in Group-Based Privilege Escalation on Linux.

Temporary and Shared Memory Filesystems

┌──(kali㉿kali)-[~]
└─$ ls -la /tmp /var/tmp /dev/shm

These are writable by all users and survive across sessions in some cases. /dev/shm is memory-backed and leaves no disk traces: preferred for staging payloads and exploit binaries. /var/tmp persists across reboots where /tmp may not.

Check for files left by other users or processes:

┌──(kali㉿kali)-[~]
└─$ ls -lat /tmp /var/tmp /dev/shm 2>/dev/null

Files owned by root or other users in these directories sometimes contain temporary credentials, sockets, or scripts worth reviewing.

World-Readable Sensitive Directories

┌──(kali㉿kali)-[~]
└─$ ls -la /var/backups/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la /var/log/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la /opt/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls -la /srv/ 2>/dev/null

/var/backups/ on Debian-based systems sometimes contains a readable copy of /etc/shadow.bak or /etc/passwd.bak. /opt/ commonly holds third-party applications with their own config files and credentials.