GRUB Boot Bypass

Physical access techniques to get a root shell by editing GRUB boot parameters.

§ table of contents

When GRUB is not password-protected, anyone with physical access can edit boot parameters and bypass authentication entirely.

At the GRUB menu, press e to edit the selected entry. Modify the line starting with linux, then press F10 to boot.

Techniques

Replaces the init process with a shell; drops directly into a root shell before any login prompt.

linux ... init=/bin/sh

Filesystem is mounted read-only by default. Remount to make changes:

mount -o remount,rw /

Same as above but uses bash. Add rw on the linux line to mount read-write from the start:

linux ... rw init=/bin/bash

Interrupts the boot process in the initramfs, before the real root filesystem is mounted. Useful for resetting the root password.

linux ... rd.break

From the initramfs shell:

mount -o remount,rw /sysroot
chroot /sysroot
passwd root
exit

Boots into maintenance mode. On some distros this drops to a root shell without a password prompt (not Debian/Ubuntu).

linux ... single

systemd equivalent of single-user mode: minimal services, root shell.

linux ... systemd.unit=rescue.target