Question

During post-exploitation on a Linux web server, a penetration tester has a shell as the low-privileged 'www-data' account. Enumeration shows that /etc/passwd is world-writable (permissions 666), while /etc/shadow remains root-owned and inaccessible. The tester has access to the 'openssl' binary. Which technique will most reliably escalate privileges to root using this misconfiguration?

Accepted Answer

Generate a password hash with 'openssl passwd', append a new root-equivalent entry (UID 0) to /etc/passwd, and log in as that account with the known password

Answer

Overwrite /etc/shadow with a crafted hash for the root user, then use 'su root' with the corresponding password

Answer

Edit /etc/passwd to change the shell of the root account to /bin/bash and run 'su root' without a password

Answer

Add the www-data user to the sudo group by editing /etc/passwd and immediately run 'sudo su -'