Enum Checklists
Structured local enumeration checklists for YOUR $LAB_VM — discipline before privesc attempts.
Visual · t19_enum_checklists
Enum checklist = ordered local recon on owned lab box. Original Cyberlium.
A checklist on a lab VM you snapshot beats random script spray on a network you do not own.
Before privesc on $LAB_VM, enumerate systematically: OS and patch level, current user and groups, network interfaces, listening ports, scheduled tasks/cron, installed software, interesting files, sudo/SUID candidates per brief allowlist. Use course checklists — WinPEAS/LinPEAS literacy may be named but run only on YOUR lab image when brief permits. Document findings in notes with redaction — not full dumps on Discord. Enumeration scope is the single $LAB_VM in RoE, not subnet sweeps or classmate boxes.
1. Windows checklist rows
User/context, hotfixes, services, autologon hints (lab only), unquoted paths literacy, token privileges — per brief.
Stop when row list complete; do not exfiltrate real credentials from host OS.
Command guide
Try these commands — Windows checklist rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
PayloadsAllTheThings PE — https://github.com/swisskyrepo/PayloadsAllTheThings (lab enum checklists literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
id find /home /opt /var/www -writable 2>/dev/null | head -20 printf 'linux: sudo -l, SUID, cron windows: whoami /priv ' > "$HOME/cyberlium-lab/t19-privesc-checklist.txt"
Primary tools to practice this lesson: python3. Reference sites: PayloadsAllTheThings PE (https://github.com/swisskyrepo/PayloadsAllTheThings). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Linux checklist rows
id, sudo -l, SUID find patterns, cron, writable /etc paths, kernel version — on $LAB_VM only.
Save summary bullets — not paste entire script output with secrets to public repos.
3. RoE discipline
Checklist applies to one VM named in RoE — not 'helpful' enum on dorm /24.
If target is not $LAB_VM, checklist stays in notebook until you deploy your lab.
4. What you ship: privesc enum checklist
Windows + Linux checklist rows (≥5 each) + $LAB_VM scope + chmod 600 storage.
5. What you record before the next lesson
Enum checklist file path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run full enum scripts on classmate VM because they shared an IP.
- Right: Checklists written for $LAB_VM. Next: PrivEsc Lab.
Mission: enum checklist draft
1) Write five Windows enum rows. 2) Write five Linux enum rows. 3) Tie checklist to $LAB_VM RoE only.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum enum before privesc attempt on lab box?”
APPLY: Enum checklist scope:
APPLY: True or False: Checklist authorizes enum on classmate hosts.
APPLY: Before privesc attempt: