> For the complete documentation index, see [llms.txt](https://strange-1.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://strange-1.gitbook.io/notes/password-attacks/linux-local-password-attacks/passwd-shadow-and-opasswd.md).

# Passwd, Shadow & Opasswd

### **Passwd File**

```bash
# It the /etc/passwd file is writable by us

# Editing /etc/passwd - Before
root:x:0:0:root:/root:/bin/bash

# Editing /etc/passwd - After
root::0:0:root:/root:/bin/bash
```

### **Shadow File**

If the password field contains a character, such as `!` or `*` the user cannot log in with a Unix password. However, other authentication methods for logging in, such as Kerberos or key-based authentication, can still be used.

#### **Algorithm Types**

* `$1$` – MD5
* `$2a$` – Blowfish
* `$2y$` – Eksblowfish
* `$5$` – SHA-256
* `$6$` – SHA-512

### **Opasswd**

The PAM library (`pam_unix.so`) can prevent reusing old passwords. The file where old passwords are stored is the `/etc/security/opasswd`. Administrator/root permissions are also required to read the file if the permissions for this file have not been changed manually.

```bash
# Reading /etc/security/opasswd 
sudo cat /etc/security/opasswd
```

### **Cracking Linux Credentials**

**Unshadow**

```bash
sudo cp /etc/passwd /tmp/passwd.bak
sudo cp /etc/shadow /tmp/shadow.bak
unshadow /tmp/passwd.bak /tmp/shadow.bak > /tmp/unshadowed.hashes
```

**Hashcat - Cracking Unshadowed Hashes**

```bash
hashcat -m 1800 -a 0 /tmp/unshadowed.hashes rockyou.txt -o /tmp/unshadowed.cracked
```

**Hashcat - Cracking MD5 Hashes**

```bash
hashcat -m 500 -a 0 md5-hashes.list rockyou.txt
```