User management

cat /etc/passwd

cry0l1t3 : x  : 1000 : 1000 :           : /home/cry0l1t3 : /bin/bash
    │      │     │      │       │               │                │
Username  Pwd   UID    GID   Comment       Home directory      Shell

# All users with an interactive shell (real accounts)
cat /etc/passwd | grep -v "nologin\|false" | cut -d: -f1

# Any account with UID 0 (root-level) besides root itself
awk -F: '$3 == 0 {print $1}' /etc/passwd

# All home directories
cat /etc/passwd | cut -d: -f1,6 | grep -v "nologin\|false"

# Clean formatted table of users, UIDs, and shells
cat /etc/passwd | grep -v "nologin\|false" | tr ":" " " | awk '{print $1, $3, $NF}' | column -t

# Requires root or sudo
sudo cat /etc/shadow

cry0l1t3:$6$wBRzy$...HASH...:18395:0:99999:7:::
    │          │                │    │   │
Username    Hash (+ algo)    Last   Min  Max
                             change  age  age

# Unshadow (combine passwd + shadow for John)
unshadow /etc/passwd /etc/shadow > hashes.txt

# Crack with John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Crack with Hashcat (SHA-512 = mode 1800)
hashcat -m 1800 hashes.txt /usr/share/wordlists/rockyou.txt

cat /etc/group

# Format: group_name:password:GID:members
# sudo:x:27:cry0l1t3,htb-student

# Who am I?
whoami

# Full identity — UID, GID, all groups
id

# My sudo rights — check EVERY entry against GTFOBins
sudo -l

# My environment — look for tokens, keys, writable PATH entries
env

# My command history — users type passwords here all the time
cat ~/.bash_history
cat ~/.zsh_history 2>/dev/null

# My SSH keys
ls -la ~/.ssh/
cat ~/.ssh/id_rsa 2>/dev/null
cat ~/.ssh/authorized_keys 2>/dev/null

# Interactive users (real login accounts)
cat /etc/passwd | grep -v "nologin\|false\|sync"

# All home directories (even if the user account is deleted)
ls -la /home/

# Who is currently logged in
who
w

# Login history
last
lastlog | grep -v "Never"

# Switch to another user (need their password)
su cry0l1t3

# Switch to root
su -

# Run a single command as another user
su -c "whoami" cry0l1t3

# Run a command as root
sudo <command>

# Run as a specific user
sudo -u www-data /bin/bash

# List what you can run
sudo -l

# Shell as root (if permitted)
sudo /bin/bash

# Both achieve a root login shell, but differently:
# su -      → authenticates as root using root's password (disabled by default on Ubuntu)
# sudo su - → authenticates as yourself, then sudo spawns a root shell (works if you're in the sudo group)
sudo su -

User cry0l1t3 may run the following commands on box:
    (root) NOPASSWD: /usr/bin/vim
#    │        │              │
#  Runas   No password   Allowed binary
#  user     needed

# Check if /etc/group is writable (rare but happens)
ls -la /etc/group

# If writable — add yourself to sudo group
usermod -aG sudo $(whoami)

# Or edit directly
sed -i 's/^sudo:.*/&,cry0l1t3/' /etc/group

# History files for all users (need root for other users' home dirs)
find /home -name ".*history" 2>/dev/null -exec cat {} \;

# SSH private keys across the system
find / -name "id_rsa" -o -name "id_ecdsa" -o -name "id_ed25519" 2>/dev/null

# Check for password reuse — try cracked passwords on all accounts
su - <other_user>   # try with cracked password

# Any .pgpass, .my.cnf, .netrc files (stored credentials)
find /home /root -name ".pgpass" -o -name ".my.cnf" -o -name ".netrc" 2>/dev/null | xargs cat