Kenobi
🔗 Kenobi
Task 1 - Deploy the machine
🎯 Target IP: 10.10.51.196
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
2.1 - Scan the machine with nmap, how many ports are open?
Task 3 - Enumerating Samba for shares
Samba is the standard Windows interoperability suite of programs for Linux and Unix. It allows end users to access and use files, printers and other commonly shared resources on a companies intranet or internet. Its often referred to as a network file system.
Samba is based on the common client/server protocol of Server Message Block (SMB). SMB is developed only for Windows, without Samba, other computer platforms would be isolated from Windows machines, even if they were part of the same network.
3.1 - How many shares have been found?
After scan of SMB ports, we need to find shares using nmap script:
On most distributions of Linux smbclient is already installed. Lets inspect one of the shares.
3.2 - Once you're connected, list the files on the share. What is the file can you see?
3.3 - What port is FTP running on?
3.4 - What mount can we see?
Your earlier nmap port scan will have shown port 111 running the service rpcbind. This is just a server that converts remote procedure call (RPC) program number into universal addresses. When an RPC service is started, it tells rpcbind the address at which it is listening and the RPC program number its prepared to serve.
Task 4 - Gain initial access with ProFtpd
ProFtpd is a free and open-source FTP server, compatible with Unix and Windows systems. Its also been vulnerable in the past software versions.
4.1 - Lets get the version of ProFtpd.
We can use searchsploit to find exploits for a particular software version.
Searchsploit is basically just a command line search tool for exploit-db.com.
4.2 - How many exploits are there for the ProFTPd running?
Task 3 - Find the Root flag
Now, we need to get root permissions to explore the root folder.
We can use the following command to list SUID files or sudo -l command:
/bin/less stands out, We can use script of this website to became a root, in this case we choose less process: https://gtfobins.github.io/gtfobins/less/
Now, we're root!
Last updated