Lab — PrivEsc
Document privesc path on YOUR $LAB_VM per brief — snapshot revert, no stranger hosts.
Visual · t19_privesc_lab
Lab: enum + privesc literacy on $LAB_VM. Original Cyberlium.
One owned lab box, one documented path, one snapshot revert — not a trophy on someone else's server.
On YOUR intentional privesc $LAB_VM under RoE: (1) run enum checklist from prior lesson; (2) follow course brief for allowed privesc path (e.g., sudo misconfig or weak service perms); (3) capture proof of elevated context with redacted screenshot or whoami/id output; (4) write defender paragraph — what control would block this on production you own; (5) snapshot revert VM. chmod 600 notes in $HOME/cyberlium-lab. No privesc on host OS, employer assets, or internet strangers. No publishing full exploit chains for non-lab Windows versions.
1. Lab execution
Verify target IP/hostname matches $LAB_VM in RoE before any command.
Use brief allowlist only — document commands at summary level, not copy-paste kitchen sink.
Command guide
Try these commands — Lab execution
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GTFOBins — https://gtfobins.github.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
id; uname -a sudo -n -l 2>/dev/null || true find / -perm -4000 2>/dev/null | head -20 getcap -r / 2>/dev/null | head -15 || true
═══ WINDOWS ═══
Command — copy this
whoami /all systeminfo | Select-String 'OS Name','OS Version','Hotfix'
Primary tools to practice this lesson: python3. Reference sites: GTFOBins (https://gtfobins.github.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence
Before/after privilege proof redacted, enum summary bullets, defender mitigation paragraph.
Link enum checklist row that led to finding.
3. Teardown
Snapshot revert or rebuild $LAB_VM. Secure notes chmod 600.
No leaving elevated backdoors — revert replaces persistence on disposable labs.
4. What you ship: privesc lab pack
Enum summary + privesc proof redacted + defender paragraph — chmod 600.
5. What you record before the next lesson
Privesc lab notes path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Privesc on roommate machine and call it OSCP practice.
- Right: Privesc documented on $LAB_VM with revert. Next: quiz.
Mission: privesc lab
1) Enum $LAB_VM per checklist. 2) Complete brief privesc path. 3) Defender paragraph + snapshot revert.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Redact proof screenshot how much?”
APPLY: PrivEsc lab target:
APPLY: True or False: Host OS privesc is acceptable homework.
APPLY: After privesc lab: