# TryHackMe Writeup: Kenobi **Room:** Kenobi () --- ## Enumeration ### Nmap Scan Starting with a full service scan: ```bash ┌──(kali㉿kali)-[~/TryHackME] └─$ nmap -sC -sV kenobi.thm Starting Nmap 7.991 ( https://nmap.org ) at 2026-10-27 22:56 +0530 Stats: 0:00:06 elapsed; 1 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 28.57% done; ETC: 22:56 (0:00:15 remaining) Nmap scan report for kenobi.thm (10.48.163.54) Host is up (0.036s latency). Not shown: 993 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp ProFTPD 1.3.5 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 5a:8b:35:62:9e:1a:fb:ad:7f:00:25:5c:38:95:ec:2e (RSA) | 256 93:7b:b9:00:0f:2a:91:8a:43:ca:23:e9:39:da:f0:4f (ECDSA) |_ 256 e8:49:7c:f1:e6:39:d2:9e:b9:a4:e6:e0:13:41:07:af (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-title: Site doesn't have a title (text/html). |_http-server-header: Apache/2.4.41 (Ubuntu) | http-robots.txt: 1 disallowed entry |_/admin.html 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 3,4 111/tcp6 rpcbind | 100000 3,4 111/udp6 rpcbind | 100003 3 2049/udp nfs | 100003 3 2049/udp6 nfs | 100003 3,4 2049/tcp nfs | 100003 3,4 2049/tcp6 nfs | 100005 1,2,3 41465/tcp6 mountd | 100005 1,2,3 45325/tcp mountd | 100005 1,2,3 45452/udp6 mountd | 100005 1,2,3 46050/udp mountd | 100021 1,3,4 35002/udp nlockmgr | 100021 1,3,4 44293/tcp6 nlockmgr | 100021 1,3,4 45565/tcp nlockmgr | 100021 1,3,4 49243/udp6 nlockmgr | 100227 3 2049/tcp nfs_acl | 100227 3 2049/tcp6 nfs_acl | 100227 3 2049/udp nfs_acl |_ 100227 3 2049/udp6 nfs_acl 139/tcp open netbios-ssn Samba smbd 4 445/tcp open netbios-ssn Samba smbd 4 2049/tcp open nfs 3-4 (RPC #100003) Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Host script results: |_clock-skew: -1s |_nbstat: NetBIOS name: KENOBI, NetBIOS user: , NetBIOS MAC: (unknown) | smb2-time: | date: 2026-10-27T17:26:48 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.92 seconds ``` > **Scan the machine with nmap, how many ports are open?** `7` ### SMB Enumeration The suggested `smb-enum-shares` script had compatibility issues, so `smbclient` was used instead: ```bash ┌──(kali㉿kali)-[~/TryHackME/kenobi] └─$ smbclient -L //10.48.163.54/ -N Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers anonymous Disk IPC$ IPC IPC Service (kenobi server (Samba, Ubuntu)) Reconnecting with SMB1 for workgroup listing. smbXcli_negprot_smb1_done: No compatible protocol selected by server. Protocol negotiation to server 10.48.163.54 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE Unable to connect with SMB1 -- no workgroup available ``` > **No of shares found : 3** Connecting to the `anonymous` share and downloading `log.txt`: ![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/cf300af7-213c-4b1f-a15c-ef6e14843809.png align="center") > **File found:** `log.txt` `log.txt` reveals that Kenobi generated an SSH key, and also tells us the FTP port in use. > **Answer:** Port **21** ### FTP : ProFTPD Version Checking the FTP version: ![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/158e77bf-6314-4272-bc66-17e39b6db1ca.png align="center") > **Answer:** **ProFTPD 1.3.5** ### Searching for Exploits Searching for known exploits for ProFTPD 1.3.5: ![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/54b15487-78f8-4044-9ff2-5ffea1efebe4.png align="center") > **Answer:** **3 exploits** found for ProFTPD 1.3.5 ### Summary of findings so far Three critical things were identified: 1. **SMB**: The `anonymous` share contains `log.txt`, which reveals that Kenobi generated an SSH key at `/home/kenobi/.ssh/id_rsa`. 2. **FTP**: ProFTPD 1.3.5 is running which vulnerable to an unauthenticated file copy exploit via `mod_copy`. 3. **NFS**: The server exports `/var`, which can be mounted from a local Kali machine. --- ## Exploitation : mod_copy The vulnerable ProFTPD module, `mod_copy`, implements two commands: - `SITE CPFR` : Copy From. Specifies the source file. - `SITE CPTO` : Copy To. Specifies the destination file. The attack chain is as follows: - Kenobi's private SSH key is at `/home/kenobi/.ssh/id_rsa`. - Direct FTP access to that path isn't possible. - But `mod_copy` allows unauthenticated file copying on the FTP server. - Copying the key into `/var/tmp` makes it accessible via the NFS export. ### Mounting /var and Retrieving the Key ![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/2d57740e-06a4-4f39-b9df-1895db6c0ef8.png align="center") After mounting `/var` from the target, `id_rsa` is accessible under `/var/tmp`. Permissions are fixed with `chmod 600`, then SSH is used to log in: ![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/71f0f45f-522d-46bd-b4d7-7bdcf581bafe.png align="center") Successfully logged in as `kenobi`. --- ## Privilege Escalation ### Finding SUID Binaries ```bash kenobi@kenobi:~$ find / -perm -u=s -type f 2>/dev/null /snap/core20/2599/usr/bin/chfn /snap/core20/2599/usr/bin/chsh /snap/core20/2599/usr/bin/gpasswd /snap/core20/2599/usr/bin/mount /snap/core20/2599/usr/bin/newgrp /snap/core20/2599/usr/bin/passwd /snap/core20/2599/usr/bin/su /snap/core20/2599/usr/bin/sudo /snap/core20/2599/usr/bin/umount /snap/core20/2599/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core20/2599/usr/lib/openssh/ssh-keysign /sbin/mount.nfs /usr/lib/policykit-1/polkit-agent-helper-1 /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/snapd/snap-confine /usr/lib/eject/dmcrypt-get-device /usr/lib/openssh/ssh-keysign /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic /usr/bin/chfn /usr/bin/newgidmap /usr/bin/pkexec /usr/bin/passwd /usr/bin/newuidmap /usr/bin/gpasswd /usr/bin/menu /usr/bin/sudo /usr/bin/chsh /usr/bin/at /usr/bin/newgrp /bin/umount /bin/fusermount /bin/mount /bin/su ``` > **Answer:** **/usr/bin/menu** stands out : it's not a standard system binary. ### Inspecting /usr/bin/menu Running the binary: !image.png > **Answer:** **3 options** are presented by the menu binary. Running `strings` on the binary to see what it calls: ![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/0883f40a-c0b4-4243-9d57-1f3d719ce329.png align="center") The binary calls `ifconfig`, `uname`, and `curl` **without absolute paths**. This makes it vulnerable to a PATH hijack attack. ### PATH Hijack Since `menu` is an SUID binary (runs as root) and calls binaries using relative names, a fake `curl` binary can be planted earlier in the PATH: ![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/11a6e26d-97e7-4209-bb58-94b6777f839f.png align="center") The `sh` binary is copied to `/tmp/curl` and given `chmod 777` permissions. Then `/tmp` is prepended to `$PATH`. When `menu` runs and calls `curl`, it finds the fake `sh` binary first and since `menu` is SUID root, the shell spawns as root. ![](https://cdn.hashnode.com/uploads/covers/6ad853adeaab421c899235b0/48af641d-d72e-40e1-ae4f-b2726333e88b.png align="center") ### Root Flag ```bash # cd /root # cat root.txt 177b3cd8562289f37382721c28381f02 ``` > **Answer:** `177b3cd8562289f37382721c28381f02`