passwd

Change a user's password. tldr-pages

GTFOBins privilege-escalation 1 documented command

How passwd is abused

documented by GTFOBins

privilege-escalation

-e

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for passwd.

1 documented command

from GTFOBins, each read by the identifier

privilege-escalation with sudo

This changes the root password to x, so it's now possible to log in using, for example, su.

echo -e 'x\nx' | passwd

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for passwd. The identifier reads the line that runs passwd.

Everyday use

from tldr-pages, CC BY 4.0

Change the password of the current user interactively

passwdIdentify

Change the password of a specific user

sudo passwd usernameIdentify

Get the current status of the user

passwd --statusIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

4 in toybox

Show every option of passwd

-a ALGOEncryption method (des, md5, sha256, sha512) default: md5

-dSet password to ''

-lLock (disable) account

-uUnlock (enable) account

passwd

How passwd is abused

1 documented command

Everyday use

Options

Other programs abused for privilege-escalation