root@rumais:~# inspect kenobi

Kenobi

Linux room covering service enumeration, initial access, and privilege escalation. This page combines the local notes, supporting artifacts, and a cleaned-up summary of the room path.

Room Details

Built from supporting notes and artifacts. This room is grouped under Linux and PrivEsc.

Summary

The standard Kenobi path is to enumerate SMB and NFS exposure, recover SSH key clues from the anonymous share, abuse the vulnerable ProFTPD copy commands to move the private key into a mountable location, log in over SSH, and finish with PATH hijacking against a SUID binary.

Notes

Recon

Network enumeration shows a Linux target exposing ftp, ssh, http, rpcbind, smb, and nfs.
SMB enumeration is the first productive branch. The anonymous share contains operational data, including the log.txt clue that references key generation activity.
RPC/NFS enumeration reveals a mountable path that becomes useful later in the attack chain.

Initial Access

Service fingerprinting on FTP points to a ProFTPD build affected by the mod_copy abuse path.
The practical workflow is to use SITE CPFR and SITE CPTO to copy Kenobi’s private key into a location reachable through the exposed NFS mount.
After mounting the exported path, the recovered SSH key can be used to authenticate as the user and establish the foothold.

Privilege Escalation

Local enumeration of SUID binaries identifies /usr/bin/menu as the interesting target.
String inspection shows commands being called without absolute paths, which makes PATH hijacking the intended escalation route.
By placing a controlled binary earlier in PATH, the SUID program can be coerced into spawning a root shell.

Security Notes

Anonymous SMB shares often leak more operational context than expected.
Exposed NFS paths and legacy FTP services are dangerous when combined with a write or copy primitive.
SUID programs that call external binaries without full paths are a recurring Linux privilege-escalation flaw.

Supporting Files

Log

Generating public/private rsa key pair. Enter file in which to save the key (/home/kenobi/.ssh/id_rsa): Created directory ‘/home/kenobi/.ssh’. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/kenobi/.ssh/id_rsa. Your public key has been saved in /home/kenobi/.ssh/id_rsa.pub. The key fingerprint is: SHA256:C17GWSl/v7KlUZrOwWxSyk+F7gYhVzsbfqkCIkr2d7Q kenobi@kenobi The key’s randomart image is: +—[RSA 2048]—-+ | | | .. | | . o. . | | ..=o +. | | . So.o++o. | | o …+oo.Bo*o | | o o ..o.o+.@oo | | . . . E .O+= . | | . . oBo. | +—-[SHA256]—–+

This is a basic ProFTPD configuration file (rename it to

‘proftpd.conf’ for actual use. It establishes a single server

“nobody” and “ftp” for normal operation and anon.

ServerName”ProFTPD Default Installation” ServerTypestandalone DefaultServeron

Port 21 is the standard FTP port.

Port21

Don’t use IPv6 support by default.

UseIPv6off

Umask 022 is a good standard umask to prevent new dirs and files

from being group and world writable.

Umask022

To prevent DoS attacks, set the maximum number of child processes

to 30. If you need to allow more than 30 concurrent connections

at once, simply increase this value. Note that this ONLY works

in standalone mode, in inetd mode you should use an inetd server

that allows you to limit maximum number of processes per service

(such as xinetd).

MaxInstances30

Set the user and group under which the server will run.

Userkenobi Groupkenobi

To cause every FTP user to be “jailed” (chrooted) into their home

directory, uncomment this line.

#DefaultRoot ~

Normally, we want files to be overwriteable.

AllowOverwriteon

Bar use of SITE CHMOD by default

DenyAll

A basic anonymous configuration, no upload directories. If you do not

want anonymous users, simply delete this entire section.

<Anonymous ~ftp> Userftp Groupftp

UserAliasanonymous ftp

Limit the maximum number of anonymous logins

MaxClients10

in each newly chdired directory.

DisplayLoginwelcome.msg DisplayChdir.message

Limit WRITE everywhere in the anonymous chroot