Which file would an attacker need to read in order to crack passwords on a modern Linux system?

/etc/passwd is world-readable but on modern Linux systems it stores only account metadata such as UID, GID, home directory, and shell, with an 'x' placeholder where password hashes used to reside.

/usr/sbin/adduser is a utility binary used to create user accounts and contains no password hashes or credential data.

%systemroot%\NTDS\NTDS.dit is the Active Directory database file on Windows Domain Controllers and is not a Linux file or path.

/etc/shadow stores the actual hashed passwords (and salts) for all user accounts on modern Linux systems. Unlike /etc/passwd, which is world-readable, /etc/shadow is restricted to root access only. An attacker who gains read access to /etc/shadow can extract the hashes and perform offline brute-force or dictionary attacks to recover plaintext passwords.