Kenobi | TryHackMe Walkthrough
Task 1
This room will cover accessing a Samba share, manipulating a vulnerable version of proftpd to gain initial access and escalate your privileges to root via an SUID binary.
Enumeration
Lets do port scanning. Run NMAP.
nmap -sV -sC -p- <ip> -T4
Lots of port are open.
Q1: Scan the machine with nmap, how many ports are open?
A: 7
Enumerating Samba for shares
Lets start enumeration from FTP.
There is no anonymous login allowed.
So, according to hint, we should start enumeration from SMB.
SMB has two ports, 445 and 139.
Since ports 139 (NetBIOS-SSN) and 445 (SMB) were open, I used enum4linux to enumerate the SMB service.
enum4linux -a <IP>
Anonymous login is allowed.
Hostname — KENOBI , builtin
There is a log file in anonymous share. Download it.
smbclient //10.49.141.18/anonymous -N
There is sha256 hash found in log.txt
Earlier nmap port scan will have shown port 111 running the service rpcbind. This is just a server that converts remote procedure call (RPC) program number into universal addresses. When an RPC service is started, it tells rpcbind the address at which it is listening and the RPC program number its prepared to serve.
In our case, port 111 is access to a network file system. Lets use nmap to enumerate this.
nmap -p 111 — script=nfs-ls,nfs-statfs,nfs-showmount <ip>
Q1: Using the nmap command above, how many shares have been found?
A: 3
Q2: Once you’re connected, list the files on the share. What is the file can you see?
A: log.txt
Q3: What port is FTP running on?
A: 21
Q4: What mount can we see?
A: /var
Gain initial access with ProFtpd
ProFtpd is a free and open-source server, compatible with Unix and Windows systems. Its also been vulnerable in the past software versions.
To check Proftpd version run nc command.
nc <ip> 21
Search ProFTPD 1.3.5 exploit via searchsploit.
We’re now going to copy Kenobi’s private key using SITE CPFR and SITE CPTO commands.
We knew that the /var directory was a mount we could see (task 2, question 4). So we’ve now moved Kenobi’s private key to the /var/tmp directory.
Get ANWAR1’s stories in your inbox
Join Medium for free to get updates from this writer.
Lets mount the /var/tmp directory to our machine
mkdir /mnt/kenobiNFS
mount <ip>:/var /mnt/kenobiNFS
ls -la /mnt/kenobiNFS
We now have a network mount on our deployed machine! We can go to /var/tmp and get the private key then login to Kenobi’s account.
And give it permission via chmod.
Run
sudo kenobi@<ip> -i <RSA Key>
We got the Kenobi’s shell.
Here is User Flag.
Q1: What is the version?
A: 1.3.5
Q2: How many exploits are there for the ProFTPd running?
A: 4
Q3: We know that the FTP service is running as the Kenobi user (from the file on the share) and an ssh key is generated for that user.
A: No answer needed
Q4: We knew that the /var directory was a mount we could see (task 2, question 4). So we’ve now moved Kenobi’s private key to the /var/tmp directory.
A: No answer needed
Q5: What is Kenobi’s user flag (/home/kenobi/user.txt)?
A: <Its your task>
Privilege Escalation with Path Variable Manipulation
Search for SUID files:
find / -perm -u=s -type f 2>/dev/null
I tried to run /usr/bin/menu and it worked.
To read this binary use strings command.
This shows us the binary is running without a full path (e.g. not using /usr/bin/curl or /usr/bin/uname). And this file has root privileges.
We copied the /bin/sh shell, called it curl, gave it the correct permissions and then put its location in our path. This meant that when the /usr/bin/menu binary was run, its using our path variable to find the “curl” binary. Which is actually a version of /usr/sh, as well as this file being run as root it runs our shell as root!
Finally! We got Root Flag.
Q1: What file looks particularly out of the ordinary?
A: /usr/bin/menu
Q2: Run the binary, how many options appear?
A: 3
Q3: Which is actually a version of /usr/sh, as well as this file being run as root it runs our shell as root!
A: No answer needed
Q4: What is the root flag (/root/root.txt)?
A: <Your Task>
