If I used an exploit to gain root access, but my ultimate goal is cracking the passwords for each user, what is the fastest way to do this?

I know I can use john on the shadow file, but if I'm in a timed environment with limited CPU power, is there a faster way that takes advantage of already being root?

3 Answers 3


If your ultimate goal is to actually get the password in plain text, then unless there's severe misconfiguration or undiscovered flaw in the password hashing method used, then no, there isn't a faster way to crack password than brute force.

Few points you could exploit: if you can get the shadow file out of the system, you could do brute force in more resourceful cloud systems like AWS or Compute Engine. Or if you can get the password salt and/or iteration count ahead ahead of time, you may be able to precompute a rainbow table.

However, most attack scenarios don't really need the plain text of the password. If you already have root, you can already do everything you ever needed to do, install ssh key for future login, alter sudoers to gain privilege on your non-root account, alter the kernel/OS to hide your changes, delete logs, etc.

If you really needed the plain text of the password, you can try altering sudo/su/sshd/bash/gpg binary to a trojaned version so that the next time the real admin typed in root password, the password will be sent to you. This may be helped by a little social engineering to convince the real admin to login to the system sooner rather than waiting indefinitely for that to happen who knows when.

  • Thanks for the info. It's actually a timed CTF on a fresh installed kali system where there's point values attached to each username/password found so whereas in real life root would be all you need, in this particular scenario it's only a means to an end. Altering that binary is definitely interesting though so I can maybe steal answers from other competitors.. will read more about that.
    – Austin
    Oct 19, 2016 at 2:50

If you are root on the system you can subvert the binaries used for login and directly capture the passwords the users enter. Depending on the strength of the passwords used and the frequency users log in this might be faster than trying to crack the passwords with brute force.

  • Any links for info on how to do this?
    – Austin
    Oct 19, 2016 at 6:04
  • 1
    @Jake: How the login is done and how passwords are checked depends on the system (i.e. PAM vs. login_passwd vs. ...). If possible get the source code for the relevant parts, add your backdoor, compile and install on your target system. Oct 19, 2016 at 6:07
  • 1
    One way to do this could be a service you setup to run at startup. You could then use ncat with ssl, so no one else gets the information, to send the dumped keystrokes to your own kali instance.
    – RLFP
    Oct 19, 2016 at 6:10

My answer is quite hypothetic but i think it's doable.

If the password have expiration times, you could use an alias for chpasswd which will log passwords and run the true chpasswd with the same options.

Of course this require some patience.

if they monitor files, they can detect this, if there is some holes in the files watched, you can put your new chpasswd in those holes and put the path before in $PATH.

The holes can either be :

  • Not watch the directory where chpasswd is stored.
  • Not watch environment variables/alias at global level. (maybe for cron too)
  • On a very hypothetic way : all files where alias environment can be defined/change for users. Because you could mock a command like one to connect a database connection and define the alias that point to your mock only for one user to get the password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .