Skip to content
HackIndex logo

HackIndex

Linux Local User and Group Enumeration

3 min read Mar 15, 2026

After landing a shell, mapping out users and groups tells you what accounts exist, which ones have elevated access, and what attack surface is available for privilege escalation or lateral movement. This is read-only enumeration — no modification, no exploitation.

Current User Context

Start by confirming who you are and what groups you belong to.

user@host ~ $ id 
uid=1001(www-data) gid=1001(www-data) groups=1001(www-data),4(adm),27(sudo)

Group membership is as important as the UID. Membership in sudo, docker, disk, adm, lxd, or shadow all represent direct privilege escalation paths. See Group-Based Privilege Escalation on Linux.

user@host ~ $ whoami
user@host ~ $ hostname

All Local Users

user@host ~ $ cat /etc/passwd

Each line is username:x:UID:GID:comment:home:shell. Focus on:

  • UID 0 accounts other than root — any second UID-0 account is a backdoor

  • Accounts with a valid login shell (/bin/bash, /bin/sh, /bin/zsh) — these can receive a shell

  • Service accounts with shells — misconfigured service accounts are common targets

  • Home directories — non-standard home paths sometimes contain credentials or keys

Filter to only accounts with login shells:

user@host ~ $ grep -v '/nologin\|/false' /etc/passwd

Filter to UID 0 accounts:

user@host ~ $ awk -F: '($3 == 0)' /etc/passwd

All Local Groups

user@host ~ $ cat /etc/group

Look for non-standard groups and check which users are members. Pay attention to groups that grant filesystem access, service control, or privilege paths:

Group

Risk

sudo / wheel

Direct sudo access

docker

Container escape to root

lxd / lxc

Container escape to root

disk

Raw disk read — access to shadow, keys

adm

Read system logs — may contain credentials

shadow

Read /etc/shadow directly

staff

May write to system directories

user@host ~ $ grep -E 'sudo|wheel|docker|lxd|disk|adm|shadow' /etc/group

Sudo Group Members

user@host ~ $ getent group sudo
user@host ~ $ getent group wheel

These users can run sudo commands. Whether they need a password depends on sudoers configuration — check that separately during vulnerability discovery.

Currently Logged-In Users

user@host ~ $ w
user@host ~ $ who
user@host ~ $ last | head -20

w shows active sessions with TTY, source IP, and what command they are running. last shows recent login history. Both help identify active users whose sessions may be hijackable, or service accounts that log in from specific hosts.

User Home Directories

user@host ~ $ ls -la /home/

Readable home directories may contain .ssh/, shell history, application configs, and stored credentials. Note which home directories you can enter — that determines what post-exploitation is possible without escalating first.

user@host ~ $ ls -la /root/

If /root/ is readable, the box is already misconfigured badly — check for keys and flag files.

Password and Shadow Files

user@host ~ $ ls -la /etc/passwd /etc/shadow /etc/sudoers

This is permission checking, not reading. If /etc/shadow is world-readable or /etc/passwd is world-writable, those are exploitable misconfigurations covered in /etc/passwd and /etc/shadow Privilege Escalation.

Service Accounts

Service accounts running daemons are worth mapping. If you can execute commands as a service account, you inherit its file access and group memberships.

user@host ~ $ ps aux | awk '{print $1}' | sort -u

Cross-reference the users running processes against /etc/passwd to see what shell and home they have.

Recent and Scheduled User Activity

user@host ~ $ lastlog | grep -v 'Never'

Shows the last login for every account that has ever logged in. Stale accounts that have not been used in months are candidates for password spraying or direct abuse if credentials surface elsewhere.