How could a hacker access the /etc/shadow file if it is only accessible by root and they do not have root access?

Question

I am reading a book on ethical hacking, and it has some examples in Python which I won't post here unless asked since this isn't Stack Overflow. But, I was wondering, if a hacker was trying to access passwords in /etc/shadow, how do they do that without root access? They can't copy it, open it; etc. Is there some brute force method?

And my /etc/shadow file is not a text file, it is a shadow file. I don't know anything about these, where can I learn?

Answer 1

In order to understand how a hacker could access this file you have to think like a hacker, mainly outside the box, of what most would consider to be "normal" methods for accessing a file.

To that end, someone could gain access to a daemon which may have root privileges, and then induce this daemon to read the contents of the /etc/shadow file. I've seen many examples throughout my career where developers or unknowledgeable sysadmins have run applications such as Tomcat or Apache as root.

These same methods can be used to augment the permissions on files as well, though a good hacker would not do something so obvious as to be detected, safer to read the contents of these files and stash them somewhere else or retrieve them from the box.

As to the type of file which /etc/shadow is, it's clearly marked as a text file on my CentOS 7.x system.

$ file /etc/shadow
/etc/shadow: regular file, no read permission

$ sudo file /etc/shadow
/etc/shadow: ASCII text

Its permissions are as follows:

$ ll /etc/shadow
----------. 1 root root 1150 Oct 29 11:44 /etc/shadow

And hashed passwords are clearly visible per user:

$ sudo grep vagrant /etc/shadow
vagrant:$1$sPqOnE53$gIcd5Q0xjmV9bM406mHpf/::0:99999:7:::

-or-

$ sudo getent shadow | grep vagrant
vagrant:$1$sPqOnE53$gIcd5Q0xjmV9bM406mHpf/::0:99999:7:::

Answer 2

1. A user cannot access /etc/shadow without root access, unless they manage to exploit a system vulnerability to cause the protection of /etc/shadow to change.  But the issue is that, if a hacker manages to gain root access by exploiting a system vulnerability, you don't want them to be able to simply read the passwords.
2. /etc/shadow is (AFAIK) a text file.  Why do you believe that it's not?  Have you tried looking at it with a text editor?  Is some file manager telling you that it is a "shadow file"?  That just means that it doesn't know, and it's making its best guess.