print the /etc/shadow file in the console

Question

How do I change the permissions of an executable file to access the /etc/shadow file?

So far I have the following bash script:

#!/bin/bash

gcc print.c -o print
chmod +s print

./print

exit 0

and the following c-code:

#include <stdio.h>
#include <stdlib.h>

int main()
{
    FILE *open = fopen("/etc/shadow", "r");
    int tmp;

    do {
      tmp = fgetc (open);
      printf("%c", tmp);
    } while (tmp != EOF);

    fclose(open);
    return 0;
}

I can easily print the /etc/passwd file, but I get a dumped core once I try to access the /etc/shadow file.

Solution 1

To give a binary permission to run things as root, you need to set the "sticky bit" on the binary.

Normally after compiling, you might see:

# ls -l print
-rwxr-xr-x  1 mark  mark  111 24 Oct 17:32 print

Setting the set-uid (sticky) bit can be done using and octal mode, or symbolically (note that you will need "root" privileges in order to change the ownership of a file):

# chown root print
# chmod o-x print
# chmod u+s print
# ls -l print
-rwsr-xr--  1 root  mark  111 24 Oct 17:32 print

In the first version, the s in the permissions, as you already figured out, indicates that this is both executable and "set-uid". But you have to changed the ownership of the file also, so that "set-uid" sets the uid of root rather than your own user. At this point, the "group" hasn't changed its value, but that's not important in this particular case. (Though it might be a factor for security.)

The final line above shows permissions that can also be expressed as an octal number, so if this is the result you want, then you could replace the two chmod lines above with a single one:

# chmod 4754 print

Have a look at the man page for chmod for more details.

If this isn't what you're looking for, please clarify your requirements in your question.

IMPORTANT NOTE: the /etc/shadow file is kept private for a reason. If you expose it with something that can be run by other users, you may compromise the security of your system. Removing world executable permission is a "nod" towards security, but if you feel that you need to expose /etc/shadow in this way, you may be solving the wrong problem.

Solution 2

It is possible without being root but you should set SUID for your program. There is 2 way to do it which are exactly same anyway.

chmod u+s [program]
chmod 4755 [program]

You may want to see SETUID

Also If you want to handle this in C :

You Should check setuid function

And If you want to do it in bash :

You should check setuid on shell scripts

Comments

[minorcaseDev]

Why do you want to read /etc/shadow?

[G-Man Says 'Reinstate Monica']

If you're running as root (logged in as root, or running under su or sudo), you shouldn't have any problem. If you don't have privileged access, you aren't going to be able to do it. … … … … … … … … … P.S. Your program should check whether the return value of fopen is NULL.

[Mark]

@Cyrus It's a permission excercise I'm trying to do

[minorcaseDev]

@Mark: Please take a look at unix.stackexchange.com/help/someone-answers Thank you.

[Mark]

it says that I do not have permission to change the ownership to root, can I go around this somehow? it is just an excercise

[ghoti]

The usual command to elevate your privilege level is sudo. You might alternately have to use su. There are man pages available for both commands.

[Mark]

the thing is that no ordinary user can access the sudo command without entering a password for a root user, and in this excercise I do not have such privileges.

[Gilles 'SO- stop being evil']

@Mark If you do not have the privilege to see the content of /etc/shadow in the first place, you won't have the privilege to install a custom program to let you do this either.