Asks for a password, and with the right one makes you tilen — who owns everything the site published and can therefore change it. Nothing you type at the prompt is shown, which is what a password prompt does; Ctrl-C abandons it. exit hands it back, and so does su guest: that account has no password at all — it is the login you arrived through — and su does not ask for a password it knows is empty.

Where the password is

Not on this filesystem. /etc/shadow belongs to root and refuses to be read, and nothing in ~ or /etc has it.

It is in this page, though. Somebody wrote it down next to the thing it unlocks and never came back for it, which is how a password actually gets out. The shell’s own JSON carries it base64’d rather than plain, so the payload is not the shortcut: read the source.

Why root is not worth the trouble

su with no user means root, and root’s account is locked — there is no password, so there is nothing to find and nothing that would work. ~/.zsh_history has the line that locked it, for anybody who gets far enough to read the history. sudo is no help either: nobody here is in that file.

What it gets you

The files in ~ that are his and not yours — the shell history, the key in .ssh — and write access to what the site published: >, >>, mv, rm, touch, chmod. Everything you change that way is marked as yours, lives in this browser and nowhere else, and is gone at the next build. A reload is a build: man tilenkoren-build.