Abusing Password Authentication
Unless a centralized credential system such as Active Directory or LDAP is used,
Linux passwords are generally stored in /etc/shadow,
which is not readable by normal users.
Historically however, password hashes, along with other account information,
were stored in the world-readable file /etc/passwd.
For backwards compatibility,
if a password hash is present in the second column
of an /etc/passwd user record, it is considered valid for authentication
and it takes precedence over the respective entry in /etc/shadow,
if available.
This means that if we can write into /etc/passwd,
we can effectively set an arbitrary password for any account.
Let’s demonstrate this.
In a previous section,
we showed that our Debian client may be vulnerable to privilege escalation
due to the fact that the /etc/passwd permissions were not set correctly.
To escalate our privileges,
let’s add another superuser (root2) and the corresponding password hash
to /etc/passwd.
We will first generate the password hash using the openssl tool
and the passwd argument.
By default, if no other option is specified,
openssl will generate a hash using the crypt algorithm,
a supported hashing mechanism for Linux authentication.
Once we have the generated hash,
we will add a line to /etc/passwd using the appropriate format:
The root2 user and the w00t password hash in our /etc/passwd record
are followed by the user id zero and the group id zero.
These zero values specify that the account we created is a superuser Linux account.
Finally, in order to verify that our modifications were valid,
we use su to switch our standard user to the newly-created root2 account.
The id command shows that we indeed have root privileges.
Even though finding /etc/passwd world-writable might seem unlikely,
many organizations implement hybrid integrations with third-party vendors
that may compromise security for easier usability.