> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/linux-privilege-escalation/adding-or-modifying-users.md).

# Adding or modifying users

## Adding user to /etc/passwd

If the `/etc/passwd` file is writeable, you can add your own user to the file.

1. Create the user password
2. Copy the line for the `root` user
3. Change the name for the user and exchange the empty password (`X`) for the created password.

### Create user password

Example #1 - MD5-password with provided salt

```bash
┌──(kali㉿kali)-[~]
└─$ openssl passwd -1 -salt THM password1
$1$THM$WnbwlliCqxFRQepUTCkUT1
```

Example #2 - SHA-256-password without provided salt

```bash
┌──(kali㉿kali)-[~]
└─$ openssl passwd -5 my_secret_password
$5$VMH9x/PgmMKax4kh$AUPi2UVv1mTuwuCZ2Q4bdYHgb86ZdfgSBmGqv651zDC
```

## Modifying user in /etc/shadow

If the `/etc/shadow` file is writeable, you can modify the password for any user (but probably most likely the `root` user).

See examples above for creating passwords.

## Usage information

<details>

<summary>openssl passwd -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ openssl passwd -h                    
Usage: passwd [options] [password]

General options:
 -help               Display this summary

Input options:
 -in infile          Read passwords from file
 -noverify           Never verify when reading password from terminal
 -stdin              Read passwords from stdin

Output options:
 -quiet              No warnings
 -table              Format output as table
 -reverse            Switch table columns

Cryptographic options:
 -salt val           Use provided salt
 -6                  SHA512-based password algorithm
 -5                  SHA256-based password algorithm
 -apr1               MD5-based password algorithm, Apache variant
 -1                  MD5-based password algorithm
 -aixmd5             AIX MD5-based password algorithm

Random state options:
 -rand val           Load the given file(s) into the random number generator
 -writerand outfile  Write random data to the specified file

Provider options:
 -provider-path val  Provider load path (must be before 'provider' argument if required)
 -provider val       Provider to load (can be specified multiple times)
 -propquery val      Property query used when fetching algorithms

Parameters:
 password            Password text to digest (optional)

```

</details>

## Resourses

openssl - Linux manual page: <https://linux.die.net/man/1/openssl>