Home > Linux

Users & Groups Enumeration

User and group enumeration is one of the most practical and results-producing tasks in Linux pentesting. It gives you direct insights into login access, privilege boundaries, misconfigurations, and privilege escalation vectors. This chapter explains every technique with hands-on commands, expected outputs, interpretation, and actionable exploitation value.

Reading /etc/passwd (Practical Enumeration)

/etc/passwd contains essential user information. It is world-readable, so even a low-privileged shell gives full visibility.

Practical command:

cat /etc/passwd

Typical output example:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
mayur:x:1000:1000:Mayur:/home/mayur:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

Interpretation:

  • Users with /bin/bash or /bin/sh are login-capable.

  • System/service accounts use /usr/sbin/nologin.

  • UID 0 means root-level user.

Find all login-capable accounts:

grep -vE "nologin|false" /etc/passwd

Find duplicate UID 0 (dangerous):

awk -F: '($3 == 0) {print $1}' /etc/passwd

If more than one result appears, the system is misconfigured and easily compromised.

Enumerating Groups & Group Memberships (Hands-On)

List all groups:

cat /etc/group

Check group membership for current user:

id

Check for a specific user:

id <username>

Look for high-risk groups:

  • sudo – direct root access

  • docker – full root breakout via container

  • lxd – instant root via unprivileged container

  • adm – read system logs

  • shadow – read password hashes

  • disk – raw disk access (full compromise)

Find all users in dangerous groups:

grep -E "sudo|docker|lxd|shadow|adm|disk" /etc/group

Enumerating /etc/shadow (When Privileged)

If you gain root or sudo access, read password hashes:

sudo cat /etc/shadow

Example:

mayur:$6$hY3w1n...:19500:0:99999:7:::

Key interpretation:

  • $6$ means SHA-512 (secure)

  • $1$ means MD5 (weak)

  • !! or * means password disabled

Weak hash algorithms are crackable using tools like Hashcat.

Finding Possible Password Cracking Opportunities

Extract all hashes into a crackable file:

sudo unshadow /etc/passwd /etc/shadow > fullhashes.txt

Crack with Hashcat (example):

hashcat -m 1800 fullhashes.txt wordlist.txt

If cracking succeeds, you gain direct login access.

Sudo Privilege Enumeration (Most Important Practical Step)

Check what you can run with sudo:

sudo -l

Example vulnerable output:

(ALL) NOPASSWD: /usr/bin/vim

If you find editors, interpreters, or shells allowed without a password, immediate root access is possible.

For example, escalate using vim:

sudo vim -c ':!/bin/bash'

Or escalate with Python:

sudo python3 -c 'import os; os.system("/bin/bash")'

Any wildcard (*) in sudo rules is extremely dangerous.

Enumerating Home Directories and Permissions

List all home directories:

ls -la /home

Check for readable .ssh folders:

find /home -maxdepth 2 -name "*.pub" -o -name "id_rsa" -ls 2>/dev/null

If private keys (id_rsa) appear readable by other users, the system is vulnerable.

Check root’s SSH directory:

sudo ls -la /root/.ssh

If misconfigured, keys can be stolen for instant root login.

Enumerating SSH Authorized Keys

Find authorized keys for all users:

grep -R "ssh-rsa" /home/*/.ssh 2>/dev/null

If you see suspicious or unknown keys, they may be backdoors.

Enumerating Locked, Disabled, or Expired Accounts

List password policies:

cat /etc/login.defs

Check aging info:

chage -l <user>

Example output:

Password expires    : never
Account expires     : never

Accounts without expiration policies are at higher risk.

Searching for Orphaned Users & Groups (Privilege Escalation Opportunity)

Find files belonging to nonexistent users:

find / -nouser -o -nogroup 2>/dev/null

If such files are writable by your user, you can plant malicious scripts or binaries.

Enumerating SUID and SGID Files via Users & Groups Context

SUID binaries run with the owner’s privileges. These often belong to root.

Find all SUID binaries:

find / -perm -4000 -type f 2>/dev/null

Find all SGID binaries:

find / -perm -2000 -type f 2>/dev/null

Look for unusual ones in /home, /opt, or custom locations—these are prime privilege-escalation points.

Process-Based Enumeration (User Context)

List processes with owners:

ps aux

Find root processes that interact with writable files:

ps aux | grep root

Find processes in dangerous groups:

ps aux | grep -E "docker|lxd"

A root process executing scripts in /tmp or /dev/shm is a direct escalation path.

Live Users Enumeration (Logged In)

View logged-in users:

who

View active sessions:

w

View last logins:

last

This helps determine user activity patterns and potential token or credential stealing opportunities.

Remote Enumeration of Users (Practical Network Techniques)

SSH version banner:

nc <target> 22

Enumerate Samba users:

enum4linux -a <target>

Enumerate usernames via SMTP VRFY:

nc <target> 25
VRFY username

Enumerate users through NFS exports:

showmount -e <target>

These remote techniques often reveal valid usernames for attacks like SSH brute-force or password spraying.

Practical Workflow Example

  1. Dump users:

cat /etc/passwd

  1. Extract login-capable accounts:

grep -vE "nologin|false" /etc/passwd

  1. Enumerate dangerous groups:

grep -E "sudo|docker|lxd|adm|shadow" /etc/group

  1. Check sudo rights:

sudo -l

  1. Check SSH keys:

find /home -name "id_rsa" -ls

  1. Enumerate SUID files:

find / -perm -4000 -type f

  1. Search for orphaned files:

find / -nouser -o -nogroup

Each step provides direct exploitation opportunities.

Intel Dump

  • /etc/passwd reveals login-capable users

  • /etc/shadow shows password hashes and algorithms

  • sudo -l identifies privilege escalation paths

  • Dangerous groups include sudo, docker, lxd, adm, shadow

  • Home directories reveal SSH keys and saved credentials

  • SSH keys with weak permissions allow unauthorized access

  • Password policies in /etc/login.defs affect cracking difficulty

  • Orphaned files and SUID binaries are escalation vectors

  • Writable shell files enable command injection on user login

  • Process ownership shows privilege flows across the system

  • Remote enumeration via SSH, Samba, NFS, and SMTP reveals valid usernames

If you want next chapter, just tell the title.

HOME LEARN COMMUNITY DASHBOARD