---
# System prepended metadata

title: KENOBI WRITE-UP BY ABDULLAH BIN OWAIS

---

# **KENOBI WRITE-UP BY ABDULLAH BIN OWAIS! (Tryhackme)**

![image](https://hackmd.io/_uploads/BkUcVmHv-e.png)

**Quick whoami:
Hello guys my name is Abdullah Bin Owais and my goal is to help you guys as much as posiible in ethical hacking and pentesting!**

**github:** https://github.com/abdullahbinowais21-boop/

# **Enumeration:**

**Nmap Scan:**
![image](https://hackmd.io/_uploads/HyfdSQrP-e.png)

**interesting finding:**
* port 80 is open
* Smb service is running(455, 139)

**We are going to focus on SMB in this write-up!**

# **Getting the user access:**
we are going to be using **smclient** and **smbmap** to look into **Samba!**

**smbmap:**
![image](https://hackmd.io/_uploads/BJ2-DmSw-e.png)
**we might be able to login as anonymous using smbclient!**
**command to run:**

![image](https://hackmd.io/_uploads/rkPtwQSPbx.png)
![image](https://hackmd.io/_uploads/Hy6pv7Sw-g.png)


**as you can see we were able to login to FTP!**
![image](https://hackmd.io/_uploads/rkpg_QBvZl.png)
**we found a file named log.txt!**
![image](https://hackmd.io/_uploads/rkVN_QSDWx.png)
**we transfered the file into our system by the help of using get!**
# 
**what did file told us:**
* **it gave us information on the machine such as groups!**
* **it also told us there is a ssh key in the machine!**

**We might be able to copy the key into tryhackme machine and mount it!**
**we can us netcat to copy id_rsa file to the tryhackme machine**
![image](https://hackmd.io/_uploads/SyHDI4rDbg.png)

**first we are going to copy the key!**
![image](https://hackmd.io/_uploads/HyegPNSPWl.png)

**after that we are copy it to the tryhackme machine!**
![image](https://hackmd.io/_uploads/B1pQdErPWg.png)

**as you can see the copy was successful!**

**now we can make i dir and then mount it!**
![image](https://hackmd.io/_uploads/r1qiuEHwbx.png)

![image](https://hackmd.io/_uploads/BkkDF4Sv-e.png)

**The mount was successful!**
![image](https://hackmd.io/_uploads/r1lRtYVrPbl.png)

**we can cd to tmp and copy the id_rsa to our system:**
![image](https://hackmd.io/_uploads/BJ6RFEHv-g.png)

**now we can finally access the machine as a unprivelleged user!**
![image](https://hackmd.io/_uploads/SJvUcNHwZe.png)

**now we successfuly got the user access!**

# Privellege Escellation:
**We are going to start off by searching for SUID's!**

![image](https://hackmd.io/_uploads/HkYVj4HwZx.png)

**usr/bin/menu looks suspicious, lets try to run it!**
![image](https://hackmd.io/_uploads/ry4KoVrvWg.png)

**it looks like a program in which it asks us some option and for those questions it gives us different answers, we can exploit this!**

**step 1:**
![image](https://hackmd.io/_uploads/HJrG2ESwZl.png)

**step 2:**
![image](https://hackmd.io/_uploads/H1DHn4Hwbe.png)

**step 3:**
![image](https://hackmd.io/_uploads/SJzq2NSDZe.png)

**Now lets run the program again!**
![image](https://hackmd.io/_uploads/SkZRn4Bvbx.png)

**as you can see we were able to get the root access.**

**From Abdullah Bin Owais**