# Linux Local User and Group Enumeration

> Enumerate local Linux users and groups via /etc/passwd, /etc/group, id, whoami, and getent to map privilege levels and identify targets.

- **URL:** https://hackindex.io/platforms/linux/enumeration/local-user-and-group-enumeration
- **Path:** Linux > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/linux/enumeration.md)
- **Published:** 2026-03-15
- **Updated:** 2026-08-11

After landing a shell, mapping out users and groups tells you what accounts exist, which ones have elevated access, and what attack surface is available for privilege escalation or lateral movement. This is read-only enumeration: no modification, no exploitation.

## Current User Context

Start by confirming who you are and what groups you belong to.

```bash
id
# uid=1001(www-data) gid=1001(www-data) groups=1001(www-data),4(adm),27(sudo)
```

Group membership is as important as the UID. Membership in `sudo`, `docker`, `disk`, `adm`, `lxd`, or `shadow` all represent direct privilege escalation paths. See [Group-Based Privilege Escalation on Linux](https://hackindex.io/platforms/linux/privilege-escalation/group-based-privilege-escalation).

```bash
whoami
hostname
```

## All Local Users

```bash
cat /etc/passwd
```

Each line is `username:x:UID:GID:comment:home:shell`. Focus on:

- UID 0 accounts other than root: any second UID-0 account is a backdoor
- Accounts with a valid login shell (`/bin/bash`, `/bin/sh`, `/bin/zsh`): these can receive a shell
- Service accounts with shells: misconfigured service accounts are common targets
- Home directories: non-standard home paths sometimes contain credentials or keys

Filter to only accounts with login shells:

```bash
grep -v '/nologin\|/false' /etc/passwd
```

Filter to UID 0 accounts:

```bash
awk -F: '($3 == 0)' /etc/passwd
```

## All Local Groups

```bash
cat /etc/group
```

Look for non-standard groups and check which users are members. Pay attention to groups that grant filesystem access, service control, or privilege paths:

| Group | Risk |
| --- | --- |
| sudo / wheel | Direct sudo access |
| docker | Container escape to root |
| lxd / lxc | Container escape to root |
| disk | Raw disk read: access to shadow, keys |
| adm | Read system logs: may contain credentials |
| shadow | Read /etc/shadow directly |
| staff | May write to system directories |

```bash
grep -E 'sudo|wheel|docker|lxd|disk|adm|shadow' /etc/group
```

## Sudo Group Members

```bash
getent group sudo
getent group wheel
```

These users can run sudo commands. Whether they need a password depends on sudoers configuration: check that separately during vulnerability discovery.

## Currently Logged-In Users

```bash
w
who
last | head -20
```

`w` shows active sessions with TTY, source IP, and what command they are running. `last` shows recent login history. Both help identify active users whose sessions may be hijackable, or service accounts that log in from specific hosts.

## User Home Directories

```bash
ls -la /home/
```

Readable home directories may contain `.ssh/`, shell history, application configs, and stored credentials. Note which home directories you can enter: that determines what post-exploitation is possible without escalating first.

```bash
ls -la /root/
```

If `/root/` is readable, the box is already misconfigured badly: check for keys and flag files.

## Password and Shadow Files

```bash
ls -la /etc/passwd /etc/shadow /etc/sudoers
```

This is permission checking, not reading. If `/etc/shadow` is world-readable or `/etc/passwd` is world-writable, those are exploitable misconfigurations covered in [/etc/passwd and /etc/shadow Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/passwd-shadow-manipulation).

## Service Accounts

Service accounts running daemons are worth mapping. If you can execute commands as a service account, you inherit its file access and group memberships.

```bash
ps aux | awk '{print $1}' | sort -u
```

Cross-reference the users running processes against `/etc/passwd` to see what shell and home they have.

## Recent and Scheduled User Activity

```bash
lastlog | grep -v 'Never'
```

Shows the last login for every account that has ever logged in. Stale accounts that have not been used in months are candidates for password spraying or direct abuse if credentials surface elsewhere.