Privilege Escalation via Insecure NFS Mounts
In this blog, I’ll walk through how I escalated my privileges from a low-privileged user to root on a remote server by abusing an insecurely configured NFS export (no_root_squash). Prologue “Control is an illusion.” — Mr. Robot NFS has a habit of trusting whoever knocks on the door — and trust, as always, is the real vulnerability. Initial Foothold At this stage I already had a shell as a regular, low-privileged user. The interesting part began while I was looking for a way up to root. ...