Loosing the root password - Printable Version

Loosing the root password - Printable Version
+- nixers (https://nixers.net)
+-- Forum: Operating Systems & Administration (https://nixers.net/Forum-Operating-Systems-Administration)
+--- Forum: Security & Cryptography (https://nixers.net/Forum-Security-Cryptography)
+--- Thread: Loosing the root password (/Thread-Loosing-the-root-password)

Loosing the root password - venam - 08-09-2016

Hello fello nixers,
This thread is about what to do if you lost your root password.

Context: My friend lost his root password and his current user automatically logs into the system without entering any password, so he doesn't remember this one either.

The solutions I could think of:

Boot from a live CD and edit the /etc/passwd to make his default user have root privileges, check validity of the file with pwck, log back in to change the root password, set everything back to normal.
Boot from a live CD and edit /etc/shadow to put a hash I'm sure of or an empty one. (I've been looking but couldn't find a tool that generates that password so I'm just going to copy it from another box).
Boot from a live CD and change the sudoers file to allow his user to be root without entering a password.
This doesn't apply here but for BSDs booting into single user mode allows changing the root password. ( https://www.openbsd.org/faq/faq8.html )

This will only work if the hard disk is not encrypted, and it's not so it's fine.

I have found those too:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-q-and-a-root-passwd.html
This one is a way to boot into single user mode linux by appending to the GRUB line:

Code:
ro root=LABEL=/

It then gives you a root shell where you can change the password.

http://askubuntu.com/questions/24006/how-do-i-reset-a-lost-administrative-password
https://help.ubuntu.com/community/LostPassword

Kind of the same spirit, choosing to boot into a rescue mode and then mounting the file system and changing the password.

There's also a mention to add this line to the grub:

Code:
init=/bin/bash

Which I assume will use bash as the init process and thus letting you have full control over the OS (source and here).

Do you have any other tips or suggestions?

Here's a bunch of resources on the topic.

RE: Loosing the root password - citrus - 08-09-2016

Although this isn't the answer your friend is looking for, if I were them, I would create a new user password, add myself to sudoers, and then lock the root account. It seems like a security hole to allow logging in as root at all.

Another technique for changing the password could be using a live CD / USB to chroot in and then change the password. I believe you have root permissions at that point.

RE: Loosing the root password - venam - 01-02-2018

(08-09-2016, 04:18 AM)citrus Wrote: Another technique for changing the password could be using a live CD / USB to chroot in and then change the password. I believe you have root permissions at that point.

This actually saved me today.
Using single usermode didn't cut it, it was mounting the file system in read-only mode which didn't let me access anything.

RE: Loosing the root password - evbo - 01-02-2018

Like citrus said, my first go-to would be systemrescuecd and a chroot

RE: Loosing the root password - xero - 02-02-2018

if you still have an account on the system, you could also go the privilege escalation route. there are a number of tools to help you identify vulns on your current machine. i've recently been taken to using the MIDA-Multitool since i actually pulls and runs multiple other tools. once you get root you can just change the password.