I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system.
The app checks if it the EUID is 0 and then creates two POSIX message queues one for the password hashes which it a child process reads using the shadow api and later sends to other worker child processes(#num defined by the user) that perform decryption attempts, and one where the workers send the weak passwords found to another child process that prints them on screen.
As stated in the instructions the app is supposed to be used by administrator users (i.e. root), which by my understanding means it is not a SUID, so no way of priviledge escalation (?).
My problem is that I don't know what to look for besides come kind of race condition or process failure scenario that can cause leakage of hashes or decrypted passwords. Is there anything that can be done by exploiting the Linker ?