Why /etc/passwd must be locked down

The account database

/etc/passwd lists every account, and any line with user ID 0 is root. If a normal user can write this file, they can simply add their own UID-0 line and become root. Check its permissions here:

ls -l /etc/passwd

In the terminal (rw for everyone (666) — anyone can rewrite the account database)

student@vulntech:~$ ls -l /etc/passwd
-rw-rw-rw- 1 root root 1067 Oct 18 13:21 /etc/passwd

Those trailing rw- bits mean world-writable. The correct permissions are 644 (rw-r--r--): readable by all, writable only by root.

Tip: The same rule applies to the whole account family: /etc/passwd should be 644, /etc/shadow 640 (root only, really), and /etc/sudoers 440. All owned by root.