# Weak file permission

first start with to know the permissions of critical file like `/etc/shadow` `/etc/passwsd`

![image.png](https://3641998078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv4bbPCMP2UOAXGuYloqD%2Fuploads%2FczgtuVkgXQGfB0cMreCb%2Fimage.png?alt=media)

we found any user on the system can read the **shadow** file

try to unshadow passwords of this file

* get two file on attacker machine `/etc/shadow` `/etc/passwsd`
* then choose **unshadow** tool → which use to print user and hashed file

<figure><img src="https://3641998078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv4bbPCMP2UOAXGuYloqD%2Fuploads%2FsaPjeuRTRZPSbnCL8NdI%2Fimage%201.png?alt=media" alt=""><figcaption></figcaption></figure>

* run john to crack this hash

<figure><img src="https://3641998078-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv4bbPCMP2UOAXGuYloqD%2Fuploads%2FgKCM34FJoekwJGNmzvqa%2Fimage%202.png?alt=media" alt=""><figcaption></figcaption></figure>

> shadow file must have privilege for other users is 0 privilege

> \--pot=deleteme.pot
