Linux Account Enumeration

Quick notes on enumerating Linux users, groups, shells, and privileged accounts.

2026-09-12

1 min read

linuxusersgroupsenumertionprivilage-escalationred-team

User Enumeration#

user enumeration

TTY1ZSH 5.9

r41n@0xraiven:~$>cat /etc/passwd

r41n@0xraiven:~$>getent passwd

r41n@0xraiven:~$>who

r41n@0xraiven:~$>w

r41n@0xraiven:~$>

Check: • Username • UID • Home directory • Login shell UID 0 accounts are especially important because they have root-level privileges.

Check group memberships for privileged groups such as: sudo wheel docker Group membership can grant significant access without directly being root.

privilege enumeration

TTY1ZSH 5.9

r41n@0xraiven:~$>id

r41n@0xraiven:~$>groups

r41n@0xraiven:~$>getent group sudo

r41n@0xraiven:~$>getent group wheel

r41n@0xraiven:~$>

Findings

INFO

Look for: • Unexpected UID 0 accounts • Users with privileged group memberships • Service accounts with login shells • Unusual home directories • Recently created accounts • Accounts with unexpected SSH access

Takeaway#

Start Linux account enumeration with users, UIDs, groups, shells, and active sessions. Privilege and access should always be considered together.

Back to Notesnote: linux-account-enumeration