---
description: |
 `getent` is a command-line utility used to fetch entries from administrative databases 
 configured in the system’s Name Service Switch (NSS), such as `passwd`, `group`, `hosts`, 
 and critically, `shadow`. While most of these databases are readable by regular users, 
 the `shadow` database is highly sensitive, containing hashed passwords for all system 
 accounts, including `root`.
 Under normal circumstances, `getent` requires root privileges to access the `shadow` database. 
 However, if the `getent` binary has the SUID bit set, a low-privileged user can abuse it to 
 retrieve password hashes, thus violating the integrity of the authentication system.
 The attacker can extract these hashes and then perform offline cracking using tools like 
 `john` or `hashcat`. This is a stealthy and shell-less method of privilege escalation that 
 works in restricted environments and minimal systems where only core utilities exist.
 This abuse works without invoking an interactive shell, interpreter, or script engine, and 
 relies purely on the logic of `getent` and the SUID bit — making it a candidate for 
 inclusion in GTFOBins under the `suid` vector.
 Example:
 ```bash
 ./getent shadow root
 # root:6ドル$saltsalt$abc...xyz:19429:0:99999:7:::