t1003-008-etcpasswd-and-etcshadow

name	T1003.008_etcpasswd-and-etcshadow
description	Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
category	authentication
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1003.008","credential-access","linux","sub-technique"]
technique_id	T1003.008
tactic	credential-access
all_tactics	["credential-access"]
platforms	["Linux"]
mitre_url	https://attack.mitre.org/techniques/T1003/008
tech_stack	["linux"]
cwe_ids	["CWE-522"]
chains_with	["T1003","T1003.001","T1003.002","T1003.003","T1003.004","T1003.005","T1003.006","T1003.007"]
prerequisites	["T1003"]
severity_boost	{"T1003":"Chain with T1003 for deeper attack path","T1003.001":"Chain with T1003.001 for deeper attack path","T1003.002":"Chain with T1003.002 for deeper attack path"}

T1003.008 /etc/passwd and /etc/shadow

Sub-technique of: T1003

High-Level Description

Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.

Linux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A "user" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.

Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command. Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db. Since the user information stored in /etc/passwd are linked to the password hashes in /etc/shadow, an adversary would need to have access to both.

Kill Chain Phase

• Credential Access (TA0006)

Platforms: Linux

What to Check

• Identify if /etc/passwd and /etc/shadow technique is applicable to target environment
• Check Linux systems for indicators of /etc/passwd and /etc/shadow
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Access /etc/shadow (Local)

/etc/shadow file is accessed in Linux environments