| name | T1003.008_etcpasswd-and-etcshadow |
| description | Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking. |
| category | authentication |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1003.008","credential-access","linux","sub-technique"] |
| technique_id | T1003.008 |
| tactic | credential-access |
| all_tactics | ["credential-access"] |
| platforms | ["Linux"] |
| mitre_url | https://attack.mitre.org/techniques/T1003/008 |
| tech_stack | ["linux"] |
| cwe_ids | ["CWE-522"] |
| chains_with | ["T1003","T1003.001","T1003.002","T1003.003","T1003.004","T1003.005","T1003.006","T1003.007"] |
| prerequisites | ["T1003"] |
| severity_boost | {"T1003":"Chain with T1003 for deeper attack path","T1003.001":"Chain with T1003.001 for deeper attack path","T1003.002":"Chain with T1003.002 for deeper attack path"} |
T1003.008 /etc/passwd and /etc/shadow
Sub-technique of: T1003
High-Level Description
Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.
Linux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A "user" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.
Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command. Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db. Since the user information stored in /etc/passwd are linked to the password hashes in /etc/shadow, an adversary would need to have access to both.
Kill Chain Phase
- Credential Access (TA0006)
Platforms: Linux
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Access /etc/shadow (Local)
/etc/shadow file is accessed in Linux environments
