Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-gcp-cos-6-1-2The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-gcp-cos-6.1.2 |
| description | Ensure permissions on /etc/shadow are configured |
| category | cis-gcp-cos |
| version | 1.2.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","container-optimized-os","file-permissions","shadow","system-files"] |
| cis_id | 6.1.2 |
| cis_benchmark | CIS Google Container-Optimized OS Benchmark v1.2.0 |
| tech_stack | ["gcp","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
The /etc/shadow file is used to store the information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information.
If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert the user accounts.
Run the following command and verify verify Uid is 0/root, Gid is 0/root or <gid>/shadow, and Access is 640 or more restrictive:
# stat /etc/shadow
Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 0/ root)
Uid should be 0/root, Gid should be 0/root or <gid>/shadow, and Access should be 640 or more restrictive.
Run the one of the following chown commands as appropriate and the chmod to set permissions on /etc/shadow:
# chown root:root /etc/shadow
# chown root:shadow /etc/shadow
# chmod o-rwx,g-wx /etc/shadow
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists | x | x | x |
| v7 | 16.4 Encrypt or Hash all Authentication Credentials | x | x |