Restoring safe permissions

Put it back to 644

Fixing the permissions is one command as root:

sudo chmod 644 /etc/passwd
ls -l /etc/passwd

In the terminal (now rw-r--r-- — only root can change it)

student@vulntech:~$ sudo chmod 644 /etc/passwd
[sudo] password for student:
student@vulntech:~$ ls -l /etc/passwd
-rw-r--r-- 1 root root 1067 Oct 18 13:21 /etc/passwd

No one but root can edit the account database now, so the ‘add a root user’ attack is dead. While you are here, it is worth confirming the file is owned by root:root — it should be.