T1003.008Credential Access
/etc/passwd and /etc/shadow
Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user. Linux stores user information such as user ID, group ID, home…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
CVEs linked to /etc/passwd and /etc/shadow
2 CVEs, by priority. Each link shows its badge.- CVE-2024-24919Check Point Quantum Security Gateways Information Disclosure VulnerabilityCheck Point · Quantum Security GatewaysKEVRansomwarePublic exploitHigh · 8.6T1059.004Unix ShellT1202Indirect Command Execution+3 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%79.0priority
- CVE-2020-3240Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataCisco · Cisco UCS DirectorCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+4 moreMITRE CTID mapping of the CVE · follow-on activity38.7%Top 1.4%26.6priority