vulnerability check on Ubuntu 18.04 Bash Shell Script

Question

MY Code

vuln=0 # initialize FLAG variable

test -f /etc/shadow # Check exist /etc/shadow
if [ $? == 1 ]
then
    vuln=1 # Not exist /etc/shadow File -> FLAG ON
else
    cat /etc/passwd | while read pass_protection # Read 1 Line
    do
        temp=`echo $pass_protection | cut -d':' -f2` # Parse the line
        if [ $temp != "x" ] # If password not encrypted
        then
            vuln=1 # FLAG ON
            break
        fi
    done
fi

if [ $vuln == 1 ] # Print Result
then
    echo "[4-1] Vuln"
else
    echo "[4-1] Not Vuln"
fi 

/etc/passwd Sample

man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
test:test_PASSWORD:10:10:test:/:/
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin

This code is Check the /etc/passwd whether password is encrypted or not

In /etc/passwd sample file, test account is not encrypted Password

But, my code cannot catch it

I found out the Initialize FLAG is affect to result

Please can i get some advise?

Thanks

Run sh -x script.sh

+ read pass_protection
+ cut -d: -f2
+ echo uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
+ temp=x
+ [ x != x ]
+ read pass_protection
+ cut -d: -f2
+ echo test:test_PASSWORD:10:10:test:/:/
+ temp=test_PASSWORD
+ [ test_PASSWORD != x ]
+ vuln=1
+ break
+ [ 0 == 1 ]
test.sh: 328: [: 0: unexpected operator
+ echo [4-1] Not Vuln
[4-1] Not Vuln

Answer 1

The problem is cat /etc/passwd | while read. Here, the right hand side of the pipe runs in a subshell. Subshells cannot affect the parent shell. Every variable set in inside while ... done is lost.

To read the file without a subshell use while ... done < /etc/passwd.

Other than that, you could condense the whole script into a single grep command:

if grep -Evq '^[^:]*:x:' /etc/passwd; then
  echo vulnerable
else
  echo ok
fi