Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog
Kenobi TryHackMe Walkthrough

Today it is time to solve another challenge called “Kenobi”. It is available at TryHackMe for penetration testing practice. The challenge is an easy difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The breakdown of the Machine with redacted flags is as follow: Level: Easy· Network Scanningo Nmap ScanEnumerationo Connecting SMB ServiceExploitationo Searching for exploit using SearchsploitPrivilege Escalationo Enumerating SUID PermissionsWalkthroughThere are two flags in this machine to discover. After Booting up the target machine from the TryHackMe: Kenobi Page, an IP will be assigned to the machine and will be visible on that page as well.IP Address: 10.10.101.175We will start a Nmap scan with the -sV from performing a Version Scan and -sC for default scripts on the target machine. nmap -sV -sC 10.10.101.175https://1.bp.blogspot.com/-fiAfgwHbELM/YRKpsbkt_mI/AAAAAAAAyIA/TZGZwfyU1HMxVxyXUpNJ1coE-IUwAw-7gCLcBGAsYHQ/s16000/1.png We have five services running on the target machine. We have 21 (FTP), 22 (SSH), 80 (HTTP), 111 & 2049 (RPC), 139 & 445 (SMB). EnumerationTo enumerate the SMB service, we will use the smbclient with the IP address of the target machine as shown in the image. We can see that there is a share by the name of anonymous. Upon accessing the share, we find a text file by the name of log.txt. We transfer the log file to our Kali machine to take a better look at it.smbclient -L \\10.10.101.175https://1.bp.blogspot.com/-YW9uMwqYc1M/YRKp5TgXoiI/AAAAAAAAyII/qeDqrwgPo-UzQ-bdwKBwNB-TZL-hllS1ACLcBGAsYHQ/s16000/2.png Reading the log, we can see that it contains the path for the id_rsa key stored on the target machine. Also, it points to the fact that the FTP service running on the target machine is ProFTPD. cat log.txthttps://1.bp.blogspot.com/-Zzo_jGcQKqs/YRKpxyjR3QI/AAAAAAAAyIE/Uk3UekyFbgsaQX5QL6Q3QbK-TxpvzTXpwCLcBGAsYHQ/s16000/3.png ExploitationAs we need to get our hands on the id_rsa file and we see that we have the ProFTPD on the target, we need to figure out a way to get access to that file through the FTP service. To check if we have any known vulnerabilities regarding the ProFTPD using Searchsploit. We see that we have the vulnerability named File Copy. We used the searchsploit to download the exploit file using the -m option. Here, we see that we need to run two significant commands: CPFR which means Copy From, and CPTO means Copy To. So we can use these commands to copy the id_rsa file from its location to a place from where we can acquire it.searchsploit ProFTPD 1.3.5https://1.bp.blogspot.com/-fv3BVdRRGKg/YRKqGdVZrgI/AAAAAAAAyIM/DX5dalHWgMk5VPz0WWvPBbz2-rxd2u6kwCLcBGAsYHQ/s16000/4.png We used netcat to connect to the FTP service on the target machine.[...]

___________________________
@hacking_Attack
@Hacking_Video

Blogspot

Kenobi TryHackMe Walkthrough

Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.

12 viewsedited 18:01

About

Blog

Apps

Platform