Users, Groups & sudo
User and group management is central to Linux security, controlling who can access what resources and run which commands. You will learn how to create and manage users, understand the /etc/passwd and /etc/shadow files, and configure sudo to grant controlled administrative access. Misconfigurations in sudo rules are one of the most common privilege escalation vectors on Linux systems.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Check current user context
Run 'id' to display your current user ID, group ID, and all supplementary groups. Run 'whoami' to confirm your username, and 'hostname' to confirm which machine you are on — essential when pivoting through multiple systems. Run 'uname -a' to get the kernel version, which you will need to search for kernel exploits. Run 'cat /etc/os-release' to identify the exact Linux distribution and version. These four commands should be the first thing you run after gaining access to any new system.
id && whoami && uname -aRead /etc/passwd
Run 'cat /etc/passwd' and look for accounts with UID 0 — any account with UID 0 has root-level privileges regardless of its username. Also look for accounts with unusual home directories (such as /var/www or /opt) which may indicate service accounts with shells that should not have them. Check for accounts with empty password fields (the second field between the first and second colons) — an empty password field means the account has no password and can be logged into without one. Export the usernames for use in brute force attacks: 'cut -d: -f1 /etc/passwd > users.txt'.
cat /etc/passwd | awk -F: '$3==0{print}'Check sudo permissions
Run 'sudo -l' to list all commands the current user is permitted to run with sudo. The output shows which commands can be run as which users — 'ALL=(ALL) NOPASSWD: ALL' means the user can run any command as root without a password, which is a complete privilege escalation. Even restricted sudo entries can be exploitable: 'sudo /usr/bin/find' allows privilege escalation via GTFOBins, and 'sudo /usr/bin/vim' allows shell escape. Always check sudo -l immediately after gaining access to a new account.
sudo -lLook up sudo binaries on GTFOBins
For each binary listed in your 'sudo -l' output, visit gtfobins.github.io and search for that binary name. Click the 'Sudo' filter to see only techniques applicable to sudo-based privilege escalation. GTFOBins provides copy-paste commands for each technique — for example, if sudo allows /usr/bin/find, the GTFOBins entry shows 'sudo find . -exec /bin/sh \; -quit' to spawn a root shell. Bookmark GTFOBins and use it as your first reference whenever you find an unusual sudo permission or SUID binary.
Escalate privileges
Using the technique identified from GTFOBins, execute the privilege escalation and verify success by running 'id' — the output should show 'uid=0(root)'. Once you have a root shell, run 'cat /etc/shadow' to confirm you can read the shadow file, which proves full system compromise. In a CTF or penetration test, the next step is to read the root flag file (typically at /root/root.txt) as proof of compromise. Document the exact commands used, the output at each step, and the time of escalation for your report.
sudo find . -exec /bin/sh \; -quit