Kenobi CTF

Welcome to my write-up for the Kenobi room on TryHackMe. This room focuses on walking through enumerating Samba shares, exploiting vulnerable versions of ProFTPD, escalating privileges via SUID binaries, and exploiting path manipulation.

Link room:https://tryhackme.com/room/kenobi

Author:0xNOVA

Platform: TryHackMe

Enumeration with nmap

We start our reconnaissance phase with an Nmap scan to discover open ports and running services on the target IP(10.130.141.57).

nmap -sC -sV 10.130.141.57

Scan results:

• Port 21 (FTP): Running ProFTPD 1.3.5, which is known to be vulnerable.
• Port 22 (SSH): OpenSSH 8.2p1 for remote login.
• Port 80 (HTTP): Apache httpd 2.4.41 hosting a web server.
• Ports 139 & 445 (SMB): Samba smbd services active for file sharing.
• Port 2049 (NFS): Network File System available for mounting shares.

Enumerating Samba Shares using Enum4linux

Following our initial port scan which revealed that Samba services are running on ports 139 and 445, we proceed to enumerate shared folders, user accounts, and system information using enum4linux.

enum4linux -A 10.130.141.57

Access the Anonymous SMB Share

Since general enumeration tools might be restricted by firewall rules or strict session configurations, we directly interact with the discovered Samba service using `smbclient` to access the `anonymous` share.

smbclient //10.130.141.57/anonymous

Listing the contents via the ls command revealed an important file named log.txt , which holds essential clues and system configuration details for the next exploitation phase.

NFS Enumeration

To discover network file system shares and check for mountable directories, we use Nmap with specialized NFS enumeration scripts targeting port 111 (`rpcbind`).

nmap -p 111 - script=nfs-ls,nfs-statfs,nfs-showmount 10.130.141.57

Mounting and Exploring the NFS Share

Get 0xNOVA71’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

After discovering that the `/var` directory is exported via NFS, we created a local mount point on our attacking machine and mounted the remote file system to inspect its contents.

sudo mkdir /mnt/kenobi-nfs
sudo mount -t nfs 10.130.141.57:/var /mnt/kenobi-nfs -o nolock
cd /mnt/kenobi-nfs
ls -la

Securing the SSH Private Key

After locating the `id_rsa` private key inside the mounted temporary directory (`/mnt/kenobi-nfs/tmp`), we copied it to our local machine’s home directory and adjusted its file permissions to meet the strict security requirements of the SSH client.

cp /mnt/kenobi-nfs/tmp/id_rsa ~/kenobi_id_rsa chmod 600 ~/kenobi_id_rsa

Gaining Initial Access

Using the secured private key extracted from the mounted NFS share, we initiated an SSH connection to authenticate as the `kenobi` user on the target machine.

ssh -i ~/kenobi_id_rsa kenobi@10.130.141.57

Capture the user flag

Privilege Escalation Enumeration (SUID Binaries)

After gaining initial access as a low-privileged user (`kenobi`), the next step in our privilege escalation phase is to search for system binaries configured with SUID (Set User ID) permissions.

find / -perm -u=s -type f 2>/dev/null

By filtering out standard system binaries, security analysts can identify custom, third-party, or misconfigured executables (such as /usr/bin/menu) that may execute commands insecurely and provide a path to full administrative access.

Capture the root flag

Key Findings

• 1. Anonymous SMB Access (Port 445):
• Finding: The Samba server permitted anonymous connections to the anonymous share.
• Impact: Allowed us to retrieve sensitive files (such as log.txt) containing internal service configurations and paths, paving the way for further enumeration.
• 2. NFS Share Misconfiguration (Port 111 / NFS):
• Finding: The target machine exported the sensitive /var directory via Network File System (NFS) without strict access controls.
• Impact: Enabled us to mount the remote file system locally on our attacking machine and gain direct read/write access to system files and temporary directories.
• Impact: Allowed us to copy the target user’s private SSH key (id_rsa) from /home/kenobi/.ssh/ into the shared NFS temporary directory (/var/tmp/), bridging our access to the file system.
• 4. SUID Binary & PATH Hijacking (/usr/bin/menu):
• Finding: A custom SUID binary located at /usr/bin/menu was discovered during privilege escalation enumeration, executing underlying system commands (like curl) via relative paths rather than absolute paths.
• Impact: Enabled us to perform a PATH Hijacking attack by placing a malicious custom script named curl inside /tmp, prepending , and executing the binary to successfully spawn an interactive root