Question

After compromising a low-privilege account on a Linux web server during an internal engagement, you want to identify additional systems and data that may extend your reach. You run 'mount' and 'cat /etc/fstab' and notice an NFS export from 10.10.20.50 mounted at /mnt/backup with 'rw' access and no root_squash restriction visible. What is the MOST useful next action to leverage this discovery for lateral movement?

Accepted Answer

Write a SUID-root binary onto the NFS share from a system where you have root, then execute it on the web server to escalate and pivot toward 10.10.20.50

Answer

Immediately delete the /mnt/backup mount point to prevent the file server from logging your access

Answer

Run a full Nmap SYN scan of the entire 10.10.20.0/24 range from the web server to map every host before touching the share

Answer

Encrypt the contents of /mnt/backup to demonstrate ransomware impact to the client