Posts on: Groups

---

Group membership is often the shortest path to root — shorter than any kernel exploit and far less risky. The critical first command after landing a shell is id or groups, because a single membership in docker, lxd, or disk is functionally equivalent to root. This file covers every group that grants a meaningful escalation primitive, ordered roughly by how directly it leads to root. 1. Docker Group Placing a user in the docker group is essentially equivalent to root-level access to the file system without requiring a password. Members can spawn new containers, and the Docker daemon runs as root.

Windows ships with privileged built-in groups whose membership grants powerful rights short of full administrator — and several are a direct path to SYSTEM or Domain Admin. Treat every group below as Tier-0 on a Domain Controller; membership changes should be monitored, and any foothold account that lands in one of them should be treated as a domain-compromise primitive. Triage — Which Group Do I Have? Run this immediately after landing a shell: