1

I am reversing a firmware update and found a empty password field in /etc/passwd

root::0:0:root:/:/bin/sh
otheruser:x:0:0:otheruser:/bin/false

Do I need a password to login as root?

I found out, that the x in the password field indicates that the hash is written in /etc/shadow, were a * indicates that the password is empty. The /etc/shadow is not included in the firmware update, so i don't know the content.

  • 1
    About the root user, it is normally not to have password in /etc/shadow because you want to use SUDO privileges instead of root user. Keep it disabled from remote logins and even local access. The only way you should access to root privileges is thru sudo. – Osakr Sep 25 '18 at 11:32
  • If you want to permit login you would set the shell to /bin/false, rigth? The question is if the missing x means that a blanc password is used – trietend Sep 25 '18 at 11:51
  • 1
    No, the shell /bin/false returns false immediately after login so you'll get logged out automatically. About the password, you're right about the blank password, currently your root user doesn't have any password assigned. You could set a ! to block the account for example – Osakr Sep 25 '18 at 11:56
  • thanks, so maybe i can get a root-shell on the device :) – trietend Sep 25 '18 at 12:16
  • 1
    However, this does not mean that SSH will allow root to log in without a password. – multithr3at3d Sep 25 '18 at 21:10
5

An empty password field means the root account can be accessed without any password.

An * or ! means the account don't have a password and no password will access the account. An x means the password is on /etc/shadow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.