Writeup “Kenobi” TryHackMe

Walkthrough on exploiting a Linux machine. Enumerate Samba for shares, manipulate a vulnerable version of proftpd and escalate your privileges with path variable manipulation.

NMAP Scan:

This is showing us which ports are open and what services are running on the box along with version number.

As we can see open ports 139/TCP and 445/TCP, to investigate further we will use nmap scripting engine. First we will check what scripts we have available for smb.

SMB Enumeration:

We will use NSE to investigate about smb on port 445.Her we gave the name of the scripts which we want to use next to — script flag.

This scan reveals that the target host has several SMB shares exposed, including an anonymous share with read/write access. From our system we connect to the machines network share as shown in the picture below then we download log.txt file to our system .WE will use tool called smbclient.

While going through this log file we can see information about ftp and port on which it is running as shown below. We already had this info from nmap scan but this log file has more info, like it is telling us that the user is Kenobi.

In the start of this writeup we saw nmap scan, where RPC program numbers are mentioned:

• RPC #100000: This is the RPC program number for the rpcbind service, which is a service that maps RPC program numbers to network port numbers.
• RPC #100003: This is the RPC program number for the nfs service, which is a protocol that allows remote access to file systems over a network.

We have following nfs scripts available to us via NSE.

Now we will enumerate nfs.

Getting the version of ProFtpd:

┌──(kali㉿kali)-[~] └─$ nc -v 10.10.52.164 21 10.10.52.164: inverse host lookup failed: Unknown host (UNKNOWN) [10.10.52.164] 21 (ftp) open 220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [10.10.52.164]

BY entering this info into the searchsploit tool we get the following output

We know that the FTP service is running as the Kenobi user (from the file on the share) and an ssh key is generated for that user.

BY using searchsploit tool we can download the file to our system as shown below.

We have the location of Kenobi's ssh key from log.txt.

According to the the exploit we found earlier: “File copy — 36742.txt”.

We can use the command: SITE CPFR to state the source file/directory and the command: SITE CPTO to state the destination file/directory.

Coppying Kenobi’s private key using SITE CPFR and SITE CPTO commands. Previously we enumerated port 111, and found out that we could see the /var directory.

Now we will mount the /var/tmp directory to our machine.

Now we will copy id_rsa to our system

Finally we log into this system using this key as shown below.

Next course of action is to try to escalate privileges.

By issuing string commands on /usr/bin/menu we get the following info.

After the sentence “Enter your choice: ” we can see the following commands:

• • Enter your choice : curl -I localhost uname -r

As we can see that the curl binary is running without binary is running without a full path (e.g. not using /usr/bin/curl).We can manipulate the path to gain a root shell.

Looking at the $PATH.

We will create a /bin/bash string into a file named curl,change the permissions of the file curl and export the /tmp directory into the $PATH environmental variable.

After updating our path when we run /usr/bin/menu we can see we are root now .