# 10. Passwords & Keys

### Introduction

While the root user’s account password is hashed and stored securely in /etc/shadow, other passwords, such as those for services may be stored in plaintext in config files.

If the root user re-used their password for a service, that password may be found and used to switch to the root user.

***

### **History Files**

History files record commands issued by users while they are using certain programs.

If a user types a password as part of a command, this password may get stored in a history file.

It is always a good idea to try switching to the root user with a discovered password.

* View the contents of all the hidden history files in the user's home directory:
  * `cat ~/.*history | less`

***

### **Config Files**

Many services and programs use configuration (config) files to store settings.

If a service needs to authenticate to something, it might store the credentials in a config file.

If these config files are accessible, and the passwords they store are reused by privileged users, we may be able to use it to log in as that user.

e.g are **openvpn** files

***

### **SSH-Keys**

SSH keys can be used instead of passwords to authenticate users using SSH.

SSH keys come in pairs: one private key, and one public key.

The private key should always be kept secret. If a user has stored their private key insecurely, anyone who can read the key may be able to log into their account using it.\*\*\*


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://notes.nomanaziz.me/cybersecurity/penetration-testing/tryhackme/main-methodology/4.-post-exploitation/privilege-escalation/linux/10.-passwords-and-keys.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.