print the /etc/shadow file in the console

Question

How do I change the permissions of an executable file to access the /etc/shadow file?

So far I have the following bash script:

#!/bin/bash

gcc print.c -o print
chmod +s print

./print

exit 0

and the following c-code:

#include <stdio.h>
#include <stdlib.h>

int main()
{
    FILE *open = fopen("/etc/shadow", "r");
    int tmp;

    do {
      tmp = fgetc (open);
      printf("%c", tmp);
    } while (tmp != EOF);

    fclose(open);
    return 0;
}

I can easily print the /etc/passwd file, but I get a dumped core once I try to access the /etc/shadow file.

Answer 1

To give a binary permission to run things as root, you need to set the "sticky bit" on the binary.

Normally after compiling, you might see:

# ls -l print
-rwxr-xr-x  1 mark  mark  111 24 Oct 17:32 print

Setting the set-uid (sticky) bit can be done using and octal mode, or symbolically (note that you will need "root" privileges in order to change the ownership of a file):

# chown root print
# chmod o-x print
# chmod u+s print
# ls -l print
-rwsr-xr--  1 root  mark  111 24 Oct 17:32 print

In the first version, the s in the permissions, as you already figured out, indicates that this is both executable and "set-uid". But you have to changed the ownership of the file also, so that "set-uid" sets the uid of root rather than your own user. At this point, the "group" hasn't changed its value, but that's not important in this particular case. (Though it might be a factor for security.)

The final line above shows permissions that can also be expressed as an octal number, so if this is the result you want, then you could replace the two chmod lines above with a single one:

# chmod 4754 print

Have a look at the man page for chmod for more details.

If this isn't what you're looking for, please clarify your requirements in your question.

IMPORTANT NOTE: the /etc/shadow file is kept private for a reason. If you expose it with something that can be run by other users, you may compromise the security of your system. Removing world executable permission is a "nod" towards security, but if you feel that you need to expose /etc/shadow in this way, you may be solving the wrong problem.

Answer 2

It is possible without being root but you should set SUID for your program. There is 2 way to do it which are exactly same anyway.

chmod u+s [program]
chmod 4755 [program]

You may want to see SETUID

Also If you want to handle this in C :

You Should check setuid function

And If you want to do it in bash :

You should check setuid on shell scripts