CEH Enumeration and System Hacking Practice Question
During a penetration test, you enumerate a Linux NFS server and discover that the /export directory is mounted with 'no_root_squash' and 'world_readable' permissions. Which of the following actions would allow you to escalate to root access on the NFS client?
⚠ Common exam trap
Watch out — candidates often confuse 'no_root_squash' with allowing direct access to sensitive files like /etc/shadow, but the actual exploit requires creating a setuid binary to escalate privileges on the client, not just reading server files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mount the share, create a setuid binary owned by root, then execute it on the client
Mounting an NFS export with 'no_root_squash' means that root on the client is treated as root on the server. By creating a setuid binary owned by root on the mounted share, any user on the client can execute that binary and gain root privileges on the client system, effectively escalating from a regular user to root.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a symbolic link to /etc/shadow on the server from the client
Why it's wrong here
Creating a symbolic link to /etc/shadow on an NFS share, even if mounted with `no_root_squash`, will not bypass the server's local file system permissions. The NFS server will still enforce that only root can read `/etc/shadow` on its local filesystem, regardless of the symlink on the share. The client's attempt to read through the symlink will be met with permission denied, as the server's access controls take precedence over the symlink itself.
- ✗
Use 'showmount -e' to list exports and then mount the share with 'mount -t nfs -o vers=3'
Why it's wrong here
`showmount -e` is used for enumerating available NFS exports, while `mount -t nfs -o vers=3` is the standard command to connect to and access a specific NFS share. While these steps are crucial for initial reconnaissance and gaining access to the shared files, they do not inherently provide any elevated privileges on the server. They merely establish a connection and allow interaction with the share under the existing permissions, without exploiting any vulnerabilities.
- ✓
Mount the share, create a setuid binary owned by root, then execute it on the client
Why this is correct
If the NFS server's export configuration includes `no_root_squash`, a client logged in as root can create files on the mounted share that retain root ownership on the server. By compiling a simple C program with the SUID bit set on this share, and then executing it on the client, the program will run with root privileges. This effectively escalates privileges on the client system by leveraging the server's trust in the client's root user, allowing arbitrary commands to execute as root.
- ✗
Run 'sudo nmap --script nfs-ls' to list files on the export
Why it's wrong here
`nmap --script nfs-ls` is a reconnaissance tool designed to list files and directories within an NFS export. While it provides valuable information about the share's contents, it is purely an enumeration technique and does not involve any privilege escalation. It cannot be used to modify server configurations, execute arbitrary code, or gain elevated access beyond what is already permitted for the user running the scan.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.