nerdexam
GIAC

GPEN · Question #414

How can a non-privileged user on a Unix system determine if shadow passwords are being used?

The correct answer is B. Read /etc/shadow and look for "x" or "II" in the second colon-delimited field. Shadow passwords on Unix systems store hashed credentials in /etc/shadow, with specific field markers indicating when shadow authentication is active.

Penetration Testing Foundations & Reconnaissance

Question

How can a non-privileged user on a Unix system determine if shadow passwords are being used?

Options

  • ARead /etc/password and look for "x" or "II" in the second colon-delimited field
  • BRead /etc/shadow and look for "x" or "II" in the second colon-delimited field
  • CVerify that /etc/password has been replaced with /etc/shadow
  • DRead /etc/shadow and look NULL values In the second comma delimited field

How the community answered

(43 responses)
  • A
    5% (2)
  • B
    79% (34)
  • C
    2% (1)
  • D
    14% (6)

Why each option

Shadow passwords on Unix systems store hashed credentials in /etc/shadow, with specific field markers indicating when shadow authentication is active.

ARead /etc/password and look for "x" or "II" in the second colon-delimited field

The filename /etc/password does not exist as a standard Unix file; the correct filename is /etc/passwd, making this option based on an incorrect file reference.

BRead /etc/shadow and look for "x" or "II" in the second colon-delimited fieldCorrect

When shadow passwords are enabled, /etc/shadow holds the actual password hashes, and the second colon-delimited field uses markers such as 'x' or '!!' to denote shadow-enabled or locked accounts. Examining this field directly confirms whether the shadow password mechanism is configured and active on the system.

CVerify that /etc/password has been replaced with /etc/shadow

Shadow passwords do not replace /etc/passwd; both files coexist, with /etc/passwd retaining user account metadata while /etc/shadow stores the password hashes.

DRead /etc/shadow and look NULL values In the second comma delimited field

/etc/shadow uses colon-delimited fields, not comma-delimited fields, so referencing comma-delimited NULL values reflects a fundamentally incorrect understanding of the file format.

Concept tested: Unix shadow password file format and field indicators

Source: https://www.man7.org/linux/man-pages/man5/shadow.5.html

Topics

#shadow passwords#Unix authentication#/etc/passwd#credential storage

Community Discussion

No community discussion yet for this question.

Full GPEN Practice