Skip to main content
Group membership alone, with no sudo rule, no SUID binary, and no exploit, is sometimes enough to reach root. Each of these groups grants access to something that was never meant to be handed to a non-root user, check groups or id during enumeration and come back here if any of these show up.

Direct Root Equivalent

Docker and LXC/LXD membership is effectively root on the host, no further exploitation needed, just the right command.

Partial Access

Disk and adm grant broad read/write or log access, useful, but needs an extra step to turn into a full shell.

​
Docker

Being in the docker group lets a user run containers without sudo, and running a container is, by design, equivalent to root on the host: docker can mount any host path into the container and read/write it as root.

​
LXC / LXD

LXD is Ubuntu’s own container manager, conceptually identical to Docker for this purpose. On many Ubuntu installs every local user is added to the lxd group automatically, often without anyone noticing the implication. Membership lets you create a privileged container (one that isn’t namespace-isolated from the host) and mount the host filesystem into it directly.

​
Disk

Members of the disk group have raw read/write access to block devices under /dev, including /dev/sda1 (or whichever device holds the root filesystem). That’s effectively full filesystem access outside of normal permission checks, debugfs can read or write any file directly off the raw device.
debugfs can also write files, not just read them, the same access used to read /etc/shadow here can just as easily overwrite /etc/passwd to add a UID-0 user (see the Writable /etc/passwd technique).

​
Adm

Members of the adm group can read every log under /var/log, not privilege escalation by itself, but a direct line into sensitive data: failed/successful login attempts, sudo invocations, cron output, and anything else an application happened to log, which routinely includes credentials typed into the wrong field.