Privilege Escalation via Writable /etc/shadow (Conceptual Overview)
The /etc/shadow file stores password hashes. If writable, attackers can replace root hash or modify user passwords.
🔒 What is /etc/shadow?
/etc/shadow contains encrypted password hashes and password aging information. It should only be readable by root.
🧠 How /etc/shadow Escalation Happens (High-Level)
- ✔ /etc/shadow is writable by non-root users
- ✔ Attacker generates new password hash
- ✔ Attacker replaces root hash with new one
- ✔ Attacker logs in as root
🔥 Why Writable /etc/shadow Is Dangerous
- ✔ Direct root password change
- ✔ No logging of modifications
- ✔ Immediate root access
🌍 Real-World Example (Defensive View)
A misconfigured application makes /etc/shadow group-writable. A user in that group replaces root hash and gains access.
🔍 Detecting Writable /etc/shadow
- ✔ Check permissions:
ls -la /etc/shadow - ✔ Monitor file integrity
🛡️ Preventing /etc/shadow Escalation
- ✔ Ensure correct permissions (600 or 640)
- ✔ Use file integrity monitoring
- ✔ Regular permission audits
🧾 Key Takeaways
- ✔ /etc/shadow must not be writable
- ✔ Monitor file permissions
- ✔ Regular audits are essential
🔒 /etc/shadow – Command Awareness
Common commands observed during audits when checking /etc/shadow. Shown for defensive awareness only.
🔍 Permission Checking
-
Check /etc/shadow permissions
Why used: Verify correct permissions (should be 600 or 640).ls -la /etc/shadow
🛡️ Defender Takeaways
- ✔ Verify /etc/shadow permissions
- ✔ Monitor file changes
