How Linux decides who is root

The account database

Every account on the system is one line in /etc/passwd. Look at root's line:

grep root /etc/passwd

In the terminal

student@vulntech:~$ grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash

The fields are separated by colons: name : password : UID : GID : comment : home : shell. The field that matters is the third one, the user ID. root's UID is 0, and UID 0 is what makes an account all-powerful — not the name. Any account with UID 0 is root.

The second field is the password. A single x means ‘the real password hash is in /etc/shadow’ (which only root can read). But if a password hash is written directly in this field, the system will accept it.

Who can write this file?

Normally only root can change /etc/passwd. Check its permissions here:

ls -l /etc/passwd

In the terminal

student@vulntech:~$ ls -l /etc/passwd
-rw-rw-rw- 1 root root 1017 Oct 19 06:12 /etc/passwd

Those permissions end in rw- for everyone — the file is world-writable. That is a serious mistake, and it is your way to root.