Privilege Escalation via Writable /etc/passwd & Shadow Abuse (Conceptual Overview)
/etc/passwd and /etc/shadow are the two most critical files for Linux user authentication. The passwd file maps usernames to user IDs (UIDs), while the shadow file stores encrypted password hashes. When these files have incorrect permissions, the entire system's authentication foundation is compromised.
📄 What Are /etc/passwd and /etc/shadow?
Stores user account information:
- Username
- User ID (UID)
- Group ID (GID)
- Home directory
- Login shell
Expected permission: -rw-r--r-- (644)
Owner: root
Group: root
Stores secure password information:
- Encrypted password hashes
- Password aging information
- Account expiration details
Expected permission: -rw-r----- (640) or -rw------- (600)
Owner: root
Group: shadow
🧠 How Privilege Escalation Happens (High-Level)
📝 Writable /etc/passwd
- ✔ A non-root user has write access to /etc/passwd
- ✔ User adds a new entry with UID 0 (root)
- ✔ New user authenticates with known password
- ✔ User gains persistent root access
🔓 Readable /etc/shadow
- ✔ A non-root user can read /etc/shadow
- ✔ Password hashes are extracted
- ✔ Hashes are cracked offline
- ✔ Plaintext passwords are recovered
✍️ Writable /etc/shadow (Rare, Catastrophic)
- ✔ User overwrites root hash with known password hash
- ✔ Root password becomes attacker-controlled
🔥 Why These Misconfigurations Are Catastrophic
- ✔ No exploit required – only file write/read capability
- ✔ Persistent access – backdoors survive reboots
- ✔ Complete control – attacker becomes root
- ✔ Difficult to detect – new user may blend in
- ✔ Immediate incident – assume breach, initiate IR
🌍 Real-World Example (Defensive View)
A system administrator writes a backup script that modifies file permissions for maintenance. Due to a logic error, the script executes:
chmod 666 /etc/passwdThe error is not noticed during the maintenance window. Any local user can now write to /etc/passwd. A non-privileged developer adds a new root user:
echo "hacker::0:0:root:/root:/bin/bash" >> /etc/passwdThe developer now has full, persistent root access to the system.
🔍 Detecting Permission Misconfigurations
- ✔ Automated file integrity monitoring – AIDE, Tripwire, Osquery
- ✔ Permission auditing – Weekly checks of critical file permissions
- ✔ User account reviews – Unexpected UID 0 entries
- ✔ Configuration management – Ansible/Puppet enforcing baseline permissions
🛡️ Preventing Passwd/Shadow Privilege Escalation
🔒 File Permission Hardening
- ✔
chmod 644 /etc/passwd– root only write - ✔
chmod 640 /etc/shadow– root:shadow read - ✔
chown root:root /etc/passwd - ✔
chown root:shadow /etc/shadow
🛡️ System Hardening
- ✔ File Integrity Monitoring (AIDE, Tripwire)
- ✔ Immutable attribute:
chattr +i /etc/passwd - ✔ Regular permission audits via cron
- ✔ SELinux/AppArmor mandatory access controls
🧾 Key Takeaways
- ✔ /etc/passwd writable = immediate root backdoor
- ✔ /etc/shadow readable = password hash exposure
- ✔ /etc/shadow writable = root password replacement
- ✔ These are permission failures, not vulnerability exploits
- ✔ Prevention requires defense in depth and monitoring
🔐 Passwd/Shadow – Command Awareness (Defensive Auditing)
Commands used by system administrators and security auditors to verify correct permissions on authentication files. Shown for defensive awareness only.
🔍 Permission Verification Commands
-
Check /etc/passwd permissions
Expected:ls -la /etc/passwd-rw-r--r--(644) -
Check /etc/shadow permissions
Expected:ls -la /etc/shadow-rw-r-----(640) or-rw-------(600) -
Check for world-writable passwd
Should return NO resultsfind /etc -name passwd -perm -o+w 2>/dev/null -
Check for world-readable shadow
Should return NO resultsfind /etc -name shadow -perm -o+r 2>/dev/null
👥 User Account Auditing
-
List all users with UID 0 (root privileges)
Should only show "root". Any other user is suspicious.awk -F: '$3==0{print $1}' /etc/passwd -
Check for accounts without passwords
Empty password field = no authentication requiredawk -F: '($2=="" ){print $1}' /etc/shadow -
List all user accounts with valid shells
Identify interactive user accountsgrep -v "/nologin\|/false" /etc/passwd
📊 File Integrity Monitoring
-
Check file checksum (detect modifications)
Compare against known-good baselinemd5sum /etc/passwd /etc/shadow -
Set immutable attribute (prevent modification)
Even root must remove immutable flag firstchattr +i /etc/passwd /etc/shadow -
Check immutable attribute status
"i" indicates immutablelsattr /etc/passwd /etc/shadow
🛡️ Remediation Commands (Defensive)
-
Fix /etc/passwd permissions
sudo chmod 644 /etc/passwd sudo chown root:root /etc/passwd -
Fix /etc/shadow permissions
sudo chmod 640 /etc/shadow sudo chown root:shadow /etc/shadow -
Remove unauthorized UID 0 user
sudo userdel -r unauthorized_user
🛡️ Defender Takeaways
- ✔ Audit weekly: Check permissions on /etc/passwd and /etc/shadow
- ✔ Monitor: Alert on any modification to these files
- ✔ Harden: Consider immutable flag on production systems
- ✔ Verify: Only one UID 0 account should exist
