# T1003.008 - /etc/passwd and /etc/shadow
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1003/008)
<blockquote>Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking. Most modern Linux operating systems use a combination of <code>/etc/passwd</code> and <code>/etc/shadow</code> to store user account information including password hashes in <code>/etc/shadow</code>. By default, <code>/etc/shadow</code> is only readable by the root user.(Citation: Linux Password and Shadow File Formats)

The Linux utility, unshadow, can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper:(Citation: nixCraft - John the Ripper) <code># /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db</code>
</blockquote>

## Atomic Tests

- [Atomic Test #1 - Access /etc/shadow (Local)](#atomic-test-1---access-etcshadow-local)

- [Atomic Test #2 - Access /etc/passwd (Local)](#atomic-test-2---access-etcpasswd-local)

- [Atomic Test #3 - Access /etc/{shadow,passwd} with a standard bin that's not cat](#atomic-test-3---access-etcshadowpasswd-with-a-standard-bin-thats-not-cat)

- [Atomic Test #4 - Access /etc/{shadow,passwd} with shell builtins](#atomic-test-4---access-etcshadowpasswd-with-shell-builtins)


<br/>

## Atomic Test #1 - Access /etc/shadow (Local)
/etc/shadow file is accessed in Linux environments

**Supported Platforms:** Linux


**auto_generated_guid:** 3723ab77-c546-403c-8fb4-bb577033b235





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Path where captured results will be placed | Path | /tmp/T1003.008.txt|


#### Attack Commands: Run with `bash`!  Elevation Required (e.g. root or admin) 


```bash
sudo cat /etc/shadow > #{output_file}
cat #{output_file}
```

#### Cleanup Commands:
```bash
rm -f #{output_file}
```





<br/>
<br/>

## Atomic Test #2 - Access /etc/passwd (Local)
/etc/passwd file is accessed in Linux environments

**Supported Platforms:** Linux


**auto_generated_guid:** 60e860b6-8ae6-49db-ad07-5e73edd88f5d





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Path where captured results will be placed | Path | /tmp/T1003.008.txt|


#### Attack Commands: Run with `sh`! 


```sh
cat /etc/passwd > #{output_file}
cat #{output_file}
```

#### Cleanup Commands:
```sh
rm -f #{output_file}
```





<br/>
<br/>

## Atomic Test #3 - Access /etc/{shadow,passwd} with a standard bin that's not cat
Dump /etc/passwd and /etc/shadow using ed

**Supported Platforms:** Linux


**auto_generated_guid:** df1a55ae-019d-4120-bc35-94f4bc5c4b0a





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Path where captured results will be placed | Path | /tmp/T1003.008.txt|


#### Attack Commands: Run with `bash`!  Elevation Required (e.g. root or admin) 


```bash
echo -e "e /etc/passwd\n,p\ne /etc/shadow\n,p\n" | ed > #{output_file}
```

#### Cleanup Commands:
```bash
rm -f #{output_file}
```





<br/>
<br/>

## Atomic Test #4 - Access /etc/{shadow,passwd} with shell builtins
Dump /etc/passwd and /etc/shadow using bash builtins

**Supported Platforms:** Linux


**auto_generated_guid:** f5aa6543-6cb2-4fae-b9c2-b96e14721713





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Path where captured results will be placed | Path | /tmp/T1003.008.txt|


#### Attack Commands: Run with `bash`!  Elevation Required (e.g. root or admin) 


```bash
function testcat(){ echo "$(< $1)"; }
testcat /etc/passwd > #{output_file}
testcat /etc/shadow > #{output_file}
```

#### Cleanup Commands:
```bash
rm -f #{output_file}
```





<br/>
