# Writable /etc/shadow

### Overview

Linux stores user authentication data across two key files:

* `/etc/passwd` – publicly readable user information
* `/etc/shadow` – **password hashes and account metadata**

If a low-privileged user can **write** to `/etc/shadow`, they can:

* Replace password hashes
* Remove passwords entirely

### Why this Works

This works because Linux authentication **fully trusts** `/etc/shadow`.

If an attacker can modify it, they can:

* Set a known password hash for root
* Remove the root password entirely
* Add a password to locked accounts

### Prerequisites

1. Local access as a non root user.
2. `/etc/shadow` has **write permissions** for non-root users.

### Steps

1. Confirm whether `/etc/shadow` is writable by the current user

   ```bash
   ls -l /etc/shadow
   ```
2. Generate a SHA-512 hash password locally 

   ```bash
   # Using openssl
   openssl passwd -6 labpassword
   # Using mkpasswd
   mkpasswd -m sha-512 labpassword
   ```
3. Open `/etc/shadow` and replace the hash with the newly generated hash.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://gokulkarthik.gitbook.io/pentesting-checklist/linux/linux-privilege-escalation/weak-file-permissions/writable-etc-shadow.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.