TryHackMe| Kenobi Write-Up
Deploying the machine and my target ip is 10.10.128.12
TASK1
First of all, doing an aggressive scan with nmap. Find ftp and ssh.
Scan the machine with nmap, how many ports are open?
7
TASK2
I use the commands given in the question.
Using the nmap command above, how many shares have been found?
3
Connect the smb and use ls command. I download it to the attacking machine with the get command.
Once you’re connected, list the files on the share. What is the file can you see?
log.txt
We can notice that rsa key pair was created.
What port is FTP running on?
21
I use the commands given in the question and we can see /var .
What mount can we see?
/var
TASK3
Get nur eskihoran’s stories in your inbox
Join Medium for free to get updates from this writer.
We can use netcat to check which version of ProFTPD is running. Then I use the commands given in the question for copying kenobi’s rsa key.
What is the version?
1.3.5
Then using searchsploit for find exploits.
How many exploits are there for the ProFTPd running?
4
I followed the given commands to mount the /var/tmp directory on the machine.
Then here is the user flag;
TASK4
For privilege escalation I can identify setuid programs that belong to the root user and could potentially pose a security risk if they have vulnerabilities that can be used by unauthorized users to gain elevated privileges. For this, I will use the command seen in the image below. And /usr/bin/menu is suspicious.
What file looks particularly out of the ordinary?
/usr/bin/menu
Then use strings /usr/bin/menu command and you can see something like this;
Run the binary, how many options appear?
3
Okay now, I create a file called curl and put /bin/sh in it. Give all permissions to the curl file that we just created by chmod a+rwx. (You can use chmod 777 but it didn’t work for me I don’t know.)
Creating fake curl command and adding it to PATH variable. Then here is the root flag;
We are done!!!
