Cracking /etc/shadow

On Linux passwords are not stored in cleartext: the /etc/shadow file holds, per user, the password hash. It is readable only by root, so being able to read it (because you have a root shell, you are in a privileged container, or you abused an arbitrary file read) is already a prize: it lets you crack passwords offline and reuse them elsewhere.

Each line's format is user:$id$salt$hash:.... The $id denotes the algorithm:

• $1$ -> MD5 (crypt)
• $5$ -> SHA-256
• $6$ -> SHA-512 (the most common today)
• $y$ / $2b$ -> yescrypt / bcrypt

To crack it with john, first combine /etc/passwd and /etc/shadow with unshadow, which produces a file where each user sits next to its hash. Then attack with a wordlist:

unshadow /etc/passwd /etc/shadow > unshadowed.txt
john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt
john --show unshadowed.txt          # show cracked results

# hashcat equivalent, choosing the mode by the hash prefix
hashcat -m 500  hash.txt /usr/share/wordlists/rockyou.txt   # $1$  md5crypt
hashcat -m 7400 hash.txt /usr/share/wordlists/rockyou.txt   # $5$  sha256crypt
hashcat -m 1800 hash.txt /usr/share/wordlists/rockyou.txt   # $6$  sha512crypt
hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt   # $2b$ bcrypt

The recovered password is then tried over SSH and on any other service: the real value of cracking /etc/shadow lies in the credential reuse that usually follows (for example, escaping a container to the host with the same username and password).

How to detect it. The cracking is offline (invisible), so detection lives in the read of /etc/shadow, not the crack. With auditd and a watch rule on /etc/shadow (-w /etc/shadow -p r -k shadow_read), any read not coming from the legitimate processes (login, sshd, passwd, unix_chkpwd) is logged: a cat/cp/unshadow on the file, or its read by a web application process (LFI), is the signal. After, the recovered password betrays itself on reuse: an SSH login (sshd in /var/log/auth.log) of that account from a new IP. The unauthorised read of /etc/shadow is the event to hunt.

Defence. Protect /etc/shadow from being read (only root should), use long and unique passwords not present in wordlists, modern algorithms (yescrypt) and do not reuse the same key between container and host.