New GTFOBin: getent for extracting privileged NSS entries via SUID

[thegreatmhn]

---

description: |
getent is a command-line utility used to fetch entries from administrative databases
configured in the system’s Name Service Switch (NSS), such as passwd, group, hosts,
and critically, shadow. While most of these databases are readable by regular users,
the shadow database is highly sensitive, containing hashed passwords for all system
accounts, including root.

Under normal circumstances, getent requires root privileges to access the shadow database.
However, if the getent binary has the SUID bit set, a low-privileged user can abuse it to
retrieve password hashes, thus violating the integrity of the authentication system.

The attacker can extract these hashes and then perform offline cracking using tools like
john or hashcat. This is a stealthy and shell-less method of privilege escalation that
works in restricted environments and minimal systems where only core utilities exist.

This abuse works without invoking an interactive shell, interpreter, or script engine, and
relies purely on the logic of getent and the SUID bit — making it a candidate for
inclusion in GTFOBins under the suid vector.

Example:

./getent shadow root
# root:$6$saltsalt$abc...xyz:19429:0:99999:7:::