You’re right. But you haven’t noticed that this is part of a pipe in that particular script:
for name in $(cut -d: -f1,3 /etc/passwd | awk -F: ‘$2 > 99 { print $1 }’)
The cut just extracts the name and uid from the password file, at which point the second field *is* the UID, and this way we can use awk to only print the username of accounts with uid’s greater than 99.
Remember, here’s a typical few lines from the Linux / Unix /etc/passwd file:
coloradoport:*:1041:1041:coloradoportraits:/home/coloradoport:/sbin/nologin
shining-light:*:1042:1042:shining-light-books:/home/shining-light:/sbin/nologin
startup101:*:1043:1043:startup101:/home/startup101:/sbin/nologin
shining-light:*:1042:1042:shining-light-books:/home/shining-light:/sbin/nologin
startup101:*:1043:1043:startup101:/home/startup101:/sbin/nologin
Of course, looking at it now, I don’t know why I didn’t just use:
for name in $(awk -F: ‘$3 > 99 { print $1 }’ /etc/passwd)
But that’s another story. 🙂
1 thought on “Bug in shell script using awk to read /etc/passwd?”
alert(‘XSS BUG Ditemukan..’)