To answer your question, your understanding is correct. The first two characters of the password hash in the shadow table is the salt value. If someone, somehow, got a hold of the password hash ...