CAS-002 · Question #816
An administrator has enabled salting for users' passwords on a UNIX box. A penetration tester must attempt to retrieve password hashes. Which of the following files must the penetration tester use…
The correct answer is A. /etc/passwd B. /etc/shadow. On modern Linux systems, /etc/passwd stores user account metadata and /etc/shadow stores the actual salted password hashes needed for offline cracking attempts.
Question
An administrator has enabled salting for users' passwords on a UNIX box. A penetration tester must attempt to retrieve password hashes. Which of the following files must the penetration tester use to eventually obtain passwords on the system? (Select TWO).
Options
- A/etc/passwd
- B/etc/shadow
- C/etc/security
- D/etc/password
- E/sbin/logon
- F/bin/bash
How the community answered
(22 responses)- A91% (20)
- E5% (1)
- F5% (1)
Why each option
On modern Linux systems, /etc/passwd stores user account metadata and /etc/shadow stores the actual salted password hashes needed for offline cracking attempts.
/etc/passwd is required because it maps usernames to their corresponding UIDs and provides the account context needed to associate hashes with specific users during analysis.
/etc/shadow stores the actual hashed and salted password values for each account, making it the primary target for hash extraction and subsequent offline cracking attempts.
/etc/security is a directory used for PAM configuration and access control rules, not for storing password hashes.
/etc/password is not a standard Linux file and does not exist on a default UNIX installation.
/sbin/logon is a login binary executable and contains no password hash data.
/bin/bash is the Bourne Again Shell executable and has no relationship to password storage.
Concept tested: Linux salted password hash storage locations
Source: https://linux.die.net/man/5/shadow
Topics
Community Discussion
No community discussion yet for this question.