TryHackMe - Kenobi Walkthrough

Key Takeaways

[Music] hey guys hackersploit here back again with another video welcome back to the try hack me series in this video we're going to be taking a look at kenobi so this is going to be part of the offensive rooms you know that you have on trihack me now the reason i actually want to go through this particular room is because it covers one important technique one important privilege escalation technique on linux and that is the exploitation of uh you know suid binaries and we'll get to that shortly but again it also covers you know various important aspects of enumerating uh services like smb on linux and of course manipulating or exploiting a vulnerable version of pro fdpd um so overall a very very good introductory box to linux exploitation and privilege escalation now um i've already started it and have the ip over here i've already deployed that so we can actually get started right over here so um in regards to the first two questions you can see i've already performed the nmap scan and we have about seven ports open or exactly seven ports open i'll just display the nmap scan for you right over here um so you can see we have a ftp port running pro ftpd 1.3.5 port 22 running open ssh we have a web server which i actually opened here you can see it's just a picture of um well you know star wars i guess uh i've gotta get bash for that in the comments but uh in any case um we have an rpc port as well running on their standard ports or running on its standard port which is one one one of course and we also have smb running on 445 and 139 and network file system or nfs right over here um all right so that is essentially seven ports which is what i entered exactly and we can now you know take a look at enumerating samba for shares all right so that's the first thing that it actually recommends doing here because we have uh you know we have smb running so if you're not familiar with what smb is smb stands for server message block now this is a protocol that allows you know users and well essentially computers on the network to communicate with each other share files resources and printers now this was implemented on windows and in regards to samba samba is the linux implementation of smb so it allows linux systems on a network to communicate with windows systems or windows machines so again it'll give you a brief description as to what it is and how it works and the key thing to note here is that it operates uh based on a client server protocol or client server communication model and again smb as it says developed only for windows and again samba is the linux implementation so the first thing it actually recommends that we do is use nmap to enumerate information regarding uh the um the actual smb shares and the smb users right and it's doing this using nmap scripts so this is one of the great reasons or one of the you know great advantages of using nmap is its um quite extensive collection of scripts that allow you can allow you to enumerate as much information as possible from your services so uh the nmap scripts if i can just list that out here so your nmap scripts are going to be stored under the user share nmap scripts directory and you can see if i type you know hit enter it will give us a whole load of lists or actually scripts um and we can use the grep utility to look for exactly the you know the service of the protocol that we're trying to enumerate information for so in this case smp and you can see we have quite a few smb scripts and in this case we're using the smb enum shares and the smb enum user script um so in order to use this all we need to do is say sudo nmap and then we specify the port here which is going to be port 445 and we then want to specify the script option and then we specify all scripts here which in this case is going to be smb edam shares and then we use a comma if we're specifying more than one script for a particular scan and in this case it's smb enum users i believe that's the correct name that is the correct name and then i paste in the ip address and we hit enter and because i'm running a privilege scandal it's going to ask me for my password it's going to say we have an issue here so that looks correct to me i don't know what i've specified incorrectly here yeah i think i found it right over here used a full stop instead of a hyphen and we'll let that run its scan and it should enumerate as much information as possible uh you know from the uh from the actual samba service that's running and um again we'll just let that complete all right so the scan is complete now it only gives us information uh or the only script that actually gives us any information is the smbe num shares script so you can see it tells us the you know the account used in this case was the guest account and we get an ipc a share which essentially is used for anonymous connections uh and that is as you can see the path the default access path is or the default path really is under the tmp directory and anonymous access we can read and write changes and then we also have the anonymous share as well as the print share which again is for printing um you know to actually share share a printer over a network and the path for the anonymous um for the actual anonymous path here is under home kenobi share all right so that's something interesting to look out for now if we take a look at the documentation here it uh it explains a very important aspect of smb all right so uh when when you're referring to smb uh and the various ports because i usually or you know it's frequently mentioned that there are two ports right you have port 139 and port 445. so on port 139 smb was again originally as it says right over here smb was originally ran on top of net bias using port 139 netbios is an older transport layer that allows windows computers to talk each other to talk to each other on the same network now they later on moved on to port 445 as you can see later versions of smb after windows 2000 began to use port 445 on top of a tcp stack and uh as you can see using a tcp stack allows smb to work over the internet so that's one of the reasons they actually added port 445 if you're ever confused and the reason they still have 139 is primarily for compatibility right and again usage of net buyers so uh using the nmap command above how many shares have been found we are able to find three shares um so let's see if that is correct that is correct all right so now it's going to tell us um we can actually start inspecting some of the shares or one of the shares rally or rather and that is of course the anonymous chair which makes the most sense because again the ipc share as i mentioned is for anonymous access and the the actual anonymous share uh has a very interesting path which is uh it actually tells us one of the users on the system even though the smb enum user script did not give us any users we can actually see that we have been able to get one user and that is the user kenobi all right so we can use the smb client the smb client utility on kelly linux which i think it actually does come with and all we need to do is type in smb client and we then provide the ip here and the you know the actual share um in this case is going to be anonymous right over here we hit enter and ask me for my password and it'll give us information regarding this particular share so it actually logs us into smb we can then list out the directory here you can see we have a file called log.txt right and we can actually get this file so i'm going to say get log.txt and what directory am i currently in or am i in currently i think it has say it has saved it to my home directory so i'll just move it should be under my home directory so we're just going to say log is it actually in that directory uh let's see is it under log i can actually see anything here like that so it should have saved it in our current directory there we are log.txt so we cut out the contents of log.txt it looks like this is a samba log although i'm not entirely sure let's actually go through it completely um there we are so you can see at the beginning it says generating public private rsa key it's just a log a general log of the server so it looks like this is uh we have a general log here and then the you know basic pro ftpd configuration file um so it actually has that there as well now in this particular case you can see that the user uh has was actually generating a public private key pair an ssh keypair and they've stored it on their home kenobi uh ssh and uh the actual keys id rsa right and you can see that it's actually created the directory there and the password was entered et cetera et cetera right so we have the private key here and the public key as well has been saved there all right so if we go back to the documentation you can see um once you're connected list the files on the share what is the file you can see and that is of course going to be log.txt right and we can submit that here it's now going to tell us you can recursively download the smb share to submit the username and password is nothing of course i think it was configured that way but we already have done or you know downloaded the the log file so we say open the file on the share there are few interesting things found information generated for kenobi when generating the ssh key for the user yes and information about pro ftpd server which we know is running on port 21 from the nmap scan so we can submit that there all right so now it's going to say your earlier nmap port scan will have shown port 111 running the service rpc bind all right so that's rpc bind uh this is just a server that converts the remote procedure called program number into universal addresses when an rpc service is started it tells rpc it tells rpc bind the address at which it is listening and the rpc program number is prepared to serve all right so in our case we can you can see port 111 is access to a network file system so um you can see we have the access control list for the uh the rpc here if i can actually go to the nmap scan where did i enumerate the nmap scan i can just display it here let me just exit from smb here cat and map there we are you can see we have the access control list here and we have rpc yeah so that makes sense um so you can also use nmap um and what we're doing here is we're simply enumerating um you know uh nfs or network file system you know information regarding the mounts it's gonna list out the contents of the network file system uh the it'll give us statistics regarding the file system and it's going to show us the amounts on the file system so again all we need to do now is we simply need to just copy this so i'll just copy this and of course we'll you know type in the rest of the command here um so we'll do this within this particular tab here so we'll just paste that in here so sudo nmap port 1111 and um paste that in there and then we need to paste in the ip address right over here and we hit enter and we can then just zoom in a little bit here so you guys can see what's going on so i'm just going to let this complete there we are it's done and you can see the volume is under the var directory and this is the information that's actually contained within this particular mount so we can see we have a we have various directories under the var amount point which is the var folder realistically speaking um and we have you know the web server i'm guessing which is under dub dub dub and uh we have snap etc all the you know typical for files and folders uh you know you're likely to find within the var folder so if we go back here you can see that we can specify the amount that we can see in this case it's going to be the var directory or the var mount point we hit enter and that is complete so i think that's done let's see what the next step is because i'm a bit confused as to how this relates to exploiting pro ftpd um but in any case let's see so the version of pro ftp being used we can get that from the nmap scan it's 1.3.5 all right so let's do that right now so 1.3.5 and that should be correct so it's going to say we can use search ploy to find exploits for a particular software version so that's true we can say um search flight uh pro ftpd 1.3.5 i think that syntax will work yeah there we are so we get various we also have a meta split module command execution which i think we can use um so you can see how many exploits are there running uh that's four for exploits so let's type that put that in there you can see it's going to say you should have found an exploit module from pro ftpd's mod copy module the mod copy module implements a site copy file and site copy file too so site copy uh copy file from and copy file two which again again these are the um this is the these are the actual commands that can be used as it says here to copy files and directories from one place to another on a server uh any of unauthenticated client can leverage these commands to copy from any part of the file system to a chosen destination um we know that the ftp service is running as the kenobi user from the file on the share that is correct so we can just complete that real quickly and we are now going to copy kenobi's private key using the site copy from to site copy 2 so we are copying the um [Music] we're copying the actual private key and we're putting it under var tmp id rsa all right so now that makes sense so essentially using the weakness within the actual uh if we actually open up the documentation here uh you can see this is the mod copy um command here or the actual mod copy module and the mod copy module implements site a copy um copy from and site copy two commands which can as it says you know that's pretty self-explanatory and it tells us right over here that this module is contained in the mod copy.c file for pro ftpd and is not compiled by default okay so that's interesting so i think in this particular case that that might be an issue as you know that's really why we have a vulnerability for 1.3 uh versions 1.3 moving forward and we can actually research more about this particular exploit here so we would say you know if we search for that here we can see rapid seven and we have the actual meta split module here so let's try and get an understanding or a feel of what this does right so it exploits the site uh copy from and copy two commands in pro ftp version 1.3.5 and as a result any unauthenticated client can leverage these commands to copy files from one part of the file system to another etc right so in this case the module will essentially give us a um [Music] a php remote code execution or a reverse shell for that matter but we're not going to be using this and this particular case is very interesting when you take a look at the documentation here is that it's actually not compiled by default right which is quite interesting and in this case we're simply just using it over here so we are connecting to ftp right and of course um i'm guessing that's going to be anonymous or unauthenticated connection we can actually try it here so netcat paste in well that's not the ap quite bad let me just copy the ip there um so if you paste that in here you can see right let's specify port 21 there we are so port 21 so pro ftp default installation and um i'm guessing we can list out a few commands ls not understood right so we can only use a few other commands as an unauthenticated user so that makes sense um so it's not actually giving us any authentication per se so the first thing we want to do is uh site copy from so we're going to say site uh copy from and uh we had you know copying it from home kenobi ssh this is the ssh directory and we're then saying id rsa and then we're saying site copy2 right and i'm guessing that's on the var and var tmp because we actually saw we have access to that particular mount that's why i was really confused here so yeah it's going to store it under the temp directory it's gonna do that for us so we're gonna hit enter and whoops looks like we have an issue there let's see well yeah we actually have to provide a file name there so site um copy 2 my bad var tmp and id rsa add sequence of commands i'm guessing i'm going to have to repeat that so we're copying from whoops my bad that's a file directory exist let me just do that one more time so site copy from okay invalid command and site copy 2 let's paste that in there and the copy successful all right so that's done now if we take a look at the documentation here um we knew that the var directory was a mount we could see you know task to question four so we've now moved kenobi's private key into the var tmp directory right so that's completed so now we can actually mount the uh the actual mount point which is under you know kenobi so we need to create a directory first where we're going to be mounting this particular mount or you know file system for that matter so we can say sudo let's create a directory so we're going to put it under mount or mnt the mnt directory on linux is the you know the de facto folder or directory where you can you you should actually be mounting uh any storage volumes etc we'll just call it kenobi right all right so that's done um so now what we want to do let's just copy the ip address over there we actually want to mount the var uh the actual var mount our network file system as it were into the mnt kenobi directory that we just created so we're going to say mount we're going to paste in the ip over here and we're going to say you know the var directory or the var mount point and we say mnt that's where we're mounting it so we're going to say kenobi hit enter that looks like we have an issue there we'll use sudo here and that should do it for us all right so i think that's done and if we list the contents of the mnt kenobi directory now so or the actual mount the mounted directory you can see we have the um we have the tmp directory uh and again we can we can access that right now um so if we list out the contents of the mnt kenobi kenobi um tmp directory you will be able to see that we have the id rsa or the actual private key for the user kenobi so that makes sense there uh so we now have a network mount um on our deployed machine we can go to the vartem directory and get the private key and then log in all right so we need to use that key that makes sense so we're gonna say sudo copy and we say mnt kenobi and we're going to tmp id rsa right that's the key we'll just copy now current directory there and that's done we can then say um you know we can give it chmod um 0 400 i think that should be fine for the permissions there we are and we say ssh i id rsa and then we say the user is kenobi and we need to copy in the ip address there which i'll do and we can paste that in there we should be able to log in i'm guessing let's see if that works out it's asking us for a password um let's try and use sudo here because that should work out invalid format do we have to convert the key not really sure no we actually get logged in as the user kenobi you can see where currently the user kenobi let's take a look at the distribution that we're currently on so we're running ubuntu 16.04 xenial xeris okay so you know that's fairly simple we can now enumerate the user flag which is under you know this directory so we can say cat user dot txt and we get the user flag right over there all right so we paste that in there and looks like we're done with this particular section or the third task and now we are taking a look at privilege escalation with path variable manipulation all right so this is interesting all right so there's a really good uh you know description or uh image here that explains you know uh that explains uh how to identify really suit binaries sgid binaries and what sticky bits are right so it's fairly simple to understand uh by looking simply at the actual permissions and what you should be looking for right so you can see suid bits can be dangerous some binaries such as password need to be run with elevated privileges that's because it's used to reset or change passwords for different users on the system however other custom files could have that uh suid bit that have the suid bit can lead to all sorts of issues to search a in the to search in a system for these types of files we can use the following find command uh which again is fairly simple to understand and um again we can use that or we can also use an automated enumeration script which i actually wanted to introduce in this video and i you know why not let's do it right now so the tool i'm talking about is linps right so i'll open up the github repository here and uh there we are lin p's this is a linux privilege escalation awesome script uh what it does it you know essentially searches for possible parts to escalate privileges uh on linux unix and mac os hosts the checks are explained in the following documentation here or that particular web page and again using it is fairly simple you just need to clone the script and you that you can then copy it to the target really easily so let's actually run this before we run the manual command um so what i'm going to do is i already have the script so i'll just close this tab here and we'll head over onto my desktop and we'll go to linux enum and we have it right over here so we have linps.sh right and we'll use a python module to set up our web server so python3m http.server and we'll run this on port 80 right and um ip let's get our ip address here the tunnel ip address or the interface ip here is listed over here so we'll actually need that we'll go into the temp directory on the kenobi system or on the target rather and we'll use wget to actually get the file so from our local system and we'll then say the script name is linpease.sh and uh yeah looks like we can actually download it so we get it there and we can say chmod plus x lin ps dot sh and then we can execute it like so lynn p's dot sh hit enter and that's going to begin enumerating now there are various options that you can actually use with lynn p's to limit the results to certain uh checks right or you know to limit the the actual searches to particular to a particular criteria which you can actually take a look at using the documentation i'll probably be making an uh an individual video to cover win peas and lin peas because of how important they are as you can see there's going to be a ton of output and what i'm going to do is i'm just going to let it go through all all of this and you can actually see right over here it actually finds the suid binaries here um and of course it'll check for easy previous exploits and write permissions and we can go through all the you know the various binaries now if we take a look at the documentation i just want to highlight something here you can see that we're looking for the suid sticky bit right um you can see it that it's applied on all of these or you know mostly some of these binaries here so the sticky bit for suid is listed right over here uh for this one or you know for uh most of these ones right over here and you can see that these are all all these are all being are all owned rather by the root user which is interesting and linpeas will of course list out any any potential vulnerabilities or any information regarding the binaries that is actually found and vulnerabilities within those binaries per se so we'll get to that in a second so i'm just going to let this complete all right so the the actual linpes script has completed i think i think it should be done now and you can see there's tons of information which is why again as i said i'm going to be making a you know an independent video on this uh but the the important thing if we go back to the suid binaries i just wanted to make sure that that is done um if i can actually scroll to the suid boundaries here it's going to take a while there we are so um you can use you know automated enumeration scripts like this or you can use your manual checks now if you take a good close look at these are pretty standard binaries that you would typically find for example you have u-mount and mount these are the you know mount and unmount binaries but if you take a look at the bottom here lynps will actually tell you there's an unknown suid binary now this is uh in most cases uh on your on properly configured systems you shouldn't be finding any binaries like this but in this case because we're dealing with a you know an educational um an educational machine here you can see that this binary looks interesting because it's a new one that's you you'll typically not find on a standard linux installation and that is user bin menu so the binary is menu right and it's owned again by the root user which means when executed it's going to run with root permissions and we know it is an suid binary now we can actually try and execute to this binary so we say menu you can see that it gives us a menu here which is interesting and the first thing the first option is status check let's actually take a look at the documentation here um and by the way you can use the manual search options here which i have covered in the past so it says what file looks particularly out of the ordinary i'm just going to say what i think right so user bin menu let's see if that's correct i may be wrong and yeah i am correct all right so run the binary how many options appear we can see that it has three options so it's it runs it as root we know that already um we can actually confirm that so lsal user bin menu you can see it runs it as the root user there we are so that's fine let's run the menu command again so we know we have three options and it simply runs you know some very basic commands we hit submit that is correct so it's now telling us to perform a little bit of reverse engineering as to uh you know to perform some very basic reverse engineering i should actually correct myself there using the strings utility um so again we can explore the you know the um the actual strings that are found within a binary of course we know we don't have the code but we can say you know for example strings user bin and menu like so and this will give us the various strings that were able to be found and you can see uh the the three commands we have the various commands that they run which is you know fairly simple uh localhost curl i which is you know checks the status kernel version you name r pretty standard and i have config which is again um a typical linux command but uh one that is you know interesting is the curl command but let's take a look a look at the documentation here um you can see this shows us that the binary is running without a full path not using user bin curl or user bin you name that's true so uh the utilities are not using the the actual relative paths right so all of these binaries you can call upon them but the way linux works is when you type in a command like ifconfig it actually checks your environment variables uh to and it'll check the the path environment variable you know for your particular session and that path environment variable will actually tell the you know we will tell linux or rather bash in this case where to look for that particular binary right so for example if i type in the environment variables for this particular user you can see that we are we have the path variable and in this case it starts off with home kenobi bin or you know the actual binary directory for the kenobi user home kenobi local bin use a local s-bin use a local bin user bin et cetera et cetera if we take a look at the documentation here you can see it tells us that we can manipulate the path to gain a root shell but you know what are we exploiting here well as it says right over here uh we copied it actually does this within the image here we can create our own curl binary as it were and uh you know put in a simple bash command that when executed will give us an elevated session uh because the menu binary is running as the root user so again we can use any i think we can actually use any of them here but we can use the example here so what we're doing is within the temp directory we can simply say echo and we say you know bin sh and we can then export that into a file called curl or rather the binary and then we give it some executable permissions 777 curl right and we have given it the executable permissions we can then export our path variable as it says here and change the actual path to um to that to the temp directory now the interesting thing here or the thing that you should note here is this is a quite interesting or a very very interesting way of doing it and one that is not really recommended because you can easily lock yourself out because you're changing the environment variables um either you're changing the path which means you pretty much will not have access to any of the other binaries so that's something that you need to take uh you know close uh you need to actually consider in the future this is not the correct way of doing it but in any case so path is going to be set to uh tmp that's the temp directory and then we are simply going to say um uh path we're gonna specify the path there we hit enter so that's gonna do it for us and um we can then launch the the menu utility or the binary and we're gonna run the first um the first status check which you use is curl and again because we specified our environment variable as the temp directory it's going to use the curl binary there so if we hit one you can see it's going to give us a uh a bond shell or a shell session rather we hit id here we can see we are currently the root user and if we head over to the root directory you can see we have the root flag here so root sorry not root flag or rather root.txt my bad and we can get the root flag right over there and i think that's pretty much it there we are so we can complete that one and paste in the root flag there and hit submit and we should be done all right so that was kenobi on tryhackme an interesting um interesting machine i should say or an interesting room for that matter uh very interesting challenges i really like the fact that they you know teaching or actually covering smb enumeration especially on linux because you know samba can be a bit confusing especially when you move on from windows to linux although the differences are quite uh few and far in between but we also have privilege escalation which is something i wanted to cover and of course i'll be covering them in depth with with other vulnerable systems in the future but triac means a great way of actually getting started with some of these techniques although as i have pointed out before they give a ton of documentation that you typically have to go out and research then that's not entirely a bad thing but again you can also for the exploitation phase you could also have used the metasploit module but it's also good to actually go through this manually um that being said that's gonna be it for this video and i'll be seeing you in the next video a huge thank you to all of our patreons uh your support is greatly appreciated and this is a formal thank you so thank you shamir douglas ryan carr sandor michael busby sits up doozy defean barry dustin empress and michael hubbard your support is greatly appreciated and you keep us making even more high quality content for you guys so thank you [Music]