> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-8/linux/trick-0328.md).

# Lateral Movement Via Su With Password

***

To switch user contexts on a Linux system using a recovered password, the `su` command is used. Execute `su <username>` and enter the password when prompted to assume the identity and privileges of that user, enabling lateral movement.

The `su` command asks for the password of the user you are switching *to*, not the user you are switching *from*. To switch to another user, you can use the `su` command followed by the username.

```bash
su <username>
# Enter the password for <username> when prompted
```

This command will ask for the password of `username`.

For a more complete session, use `su - username`. The hyphen makes the shell a login shell, meaning it will run the target user's startup files (like `.bashrc`, `.profile`) and change the current directory to their home directory.

```bash
su - <username>
# Enter the password for <username> when prompted
```