Windows

Linux

1. Get the password hash:
   cat /etc/shadow
2. Check if there is any other connection:
   netstat -antup
3. Check home directory for any more information:
   ls -lahR /home
4. Check if there is GUI interface:
   pidof X
   (if yes can try to find web browser with any loot (e.g. history, saved passwords, homepage etc), or “recently opened” applications/files)
5. Search password related file in current path, recursive:
   grep -R 'password'.
6. Search file:
   find / -type f -name "network-secret.txt"
7. After root access, can change local password via:
   passwd username