Privilege Levels Without Exploit Recipes

Least privilege is a control, not a poster. A payroll clerk's account should not be in the local Administrators group. A web app's service account should not be root. Your daily desktop login should not be the same identity you use to approve UAC or sudo. When every click runs as admin, one phished session or one malicious attachment inherits the keys to the box. When the daily identity is a standard user, the same event is still bad — mail, files, tokens that user could already touch — but it is not automatically a kernel-wide rewrite. That gap is the whole lesson. Exam language that says “escalate privileges” names the gap. This course names the control. It does not fill the gap with a recipe.

Write the control in operations language you already used in Module 4 lockdown: bind teaching listeners to loopback; do not leave 0.0.0.0 on a café; throwaway folders instead of serving $HOME. Privilege is the same idea on identities. Do not live as root “because it is easier.” Do not share one admin password on a family PC without knowing who is admin. Do not add your homework user to sudo with NOPASSWD for convenience on a laptop that also holds mail. Convenience is how least privilege dies without a CVE.

id || whoami; echo 'groups:'; id -nG

cat >> "$NOTES" << 'EOF'
least_privilege: smallest rights that still do the job
this_account: (paste id/whoami in YOUR words)
EOF

A standard user can usually change their own files, run programs in their profile, and talk to the network as that identity. An administrator or root can change system configuration, other users' files, services, and (on many systems) kernel-related settings. Those are different doors. Logging should tell them apart: “alice ran a browser” is not “alice installed a service.” If your notes cannot say which door an event used, you cannot tell a defender story. Windows splits Standard vs Administrator (UAC is a prompt, not magic). Unix-like systems split UID 0 from everyone else; sudo is a controlled, logged promotion if configured that way — not a hidden exploit. You may read `whoami` / `id` on YOUR box to see which identity you are. You may not follow a blog that turns that identity into a kernel writeup.

UAC and sudo are speed bumps and audit points when they are not disabled. They are not “the exploit.” Disabling UAC so games stop prompting is a control failure you chose. Granting a web directory 777 so PHP can write is a control failure you chose. Running the browser as root because a tutorial said so is a control failure you chose. None of those require a kernel bug. This module will keep repeating that, because the failure mode is students skipping from “I have a user shell in a movie” to “here is how you steal SYSTEM” and calling it education. Cyberlium stops at the control.

sudo apt install python3

brew install python3

python3 - << 'PY'
import os
euid = getattr(os, 'geteuid', lambda: 'n/a-on-windows')()
print('euid', euid, 'is_root', euid == 0)
print('user_door vs admin_door: two logs, two blast radii')
print('ethics: I do not exploit a classmate to become admin')
PY

If an attacker (or a phish) has a standard user's password or session, they have what that user had: that user's files, that user's mail if the client is logged in, that user's cloud tokens if they sit on disk, processes that user can start. That is already an incident. It is not, by itself, domain admin, root, or every other account. Treating it as “full box owned” trains you to skip containment: disable that user, revoke sessions, rotate secrets that user could reach — Module 5 treatment language — instead of pretending you must immediately chase a kernel bug. Privilege escalation as a concept means “a control that kept user ≠ admin failed.” As a lab in this course it means you inspect YOUR groups and sudoers/UAC posture. It does not mean a walkthrough of a local exploit.

Authorized testers still report “user can become admin because X” when X is a misconfiguration they are hired to find: everyone in a group that should not be admin; a service running as SYSTEM with a writable path the user can change; a sudoers line that is too broad. Reporting X is documentation (next lesson). Building a public recipe from X for strangers is out. Kernel memory corruption writeups, token impersonation kits, and credential-dumping tools named in underground blogs are out of this file, out of the notes, and out of the Mentor ask. If you cannot describe the failure without an exploit string, describe the control instead: this identity should not have been admin.

cat >> "$NOTES" << 'EOF'
compromised_user_impact: what THAT identity could already read/change
not_automatic: user => admin without a separate control failure
refuse: kernel exploit recipes, UAC bypass kits
EOF

On YOUR machine: know whether the account you browse with is an administrator. If it is, that is a finding for you, not a trophy. Create or use a standard user for daily work where the OS allows it. Keep a separate admin identity for installs and system changes. Do not disable UAC to silence prompts. Do not alias sudo to skip passwords on a laptop that holds your password manager. Record what you observed — not a neighbor's `id` output, not a campus lab login you do not own. chmod 600 the notes. Empty files fail. Files that contain exploit steps fail even if you never ran them.

A useful failure: you run `whoami` as your normal account, see you are already admin, and feel the lesson is “too easy.” That feeling is the lesson. Easy admin is the control failure. Next lesson will ask what you would log when that identity does something sensitive — and why you never wipe those logs on a box that is not yours.

On a computer you own, create cyberlium-lab if needed. Run whoami (and id on Unix-like) only for your session. Fill the notes with definitions and what you observed about YOUR account. Do not scan other users' homes. Do not follow an escalation gist. chmod 600.

sudo apt install python3

brew install python3

cd "$HOME/cyberlium-lab"

cat > privilege_whoami.py << 'PY'
import os
import getpass

print("login_name:", getpass.getuser())
print("uid_if_posix:", getattr(os, "getuid", lambda: "n/a-windows")())
print("euid_if_posix:", getattr(os, "geteuid", lambda: "n/a-windows")())
print("cwd:", os.getcwd())
print("note: being a daily admin is a control finding, not a trophy")
print("ethics: my session only; no /etc/passwd harvest; no escalation recipe")
PY

python3 privilege_whoami.py || python privilege_whoami.py

{

You now treat user and admin as two doors. Least privilege is the control that keeps a phished browser from rewriting the kernel. A compromised user is an incident, not an automatic root. Notes are locked. This is original Cyberlium teaching mapped to a CEH v13 domain — not official EC-Council training, not a cert, not exam dumps. Next — Persistence and Logs as a Defender — why testers document findings, and why you never hide tracks on someone else's box.