> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/kenobi.md).

# Kenobi

![](/files/-Mcu4Y57TdtOW8L8O6jT)

## Deploy the vulnerable machine

Lets run nmap scans to find open ports and what services are running on them

![](/files/-Mcu5aSO9n9xbo_HQW3O)

![](/files/-Mcu5hap3I_WNVuJhelw)

![](/files/-Mcu60IaVTL5UYimDby8)

## Enumerating Samba for shares

![](/files/-Mcu6PE4MTyWoHHZKQKm)

![](/files/-Mcu6nz7syHQv0rOluie)

![](/files/-Mcu6rghe4Ptzt-DZjUl)

![](/files/-Mcu777346ENzpCgkmSN)

![](/files/-Mcu7AhTBJ4IuY5q3TrJ)

Lets read the file

![](/files/-Mcu7QWd0CeVRXhDXJaI)

![](/files/-Mcu7YKAxpqG7RbGhm7E)

![](/files/-Mcu7anRSA2Itcz-oB0-)

## Gain initials access with ProFtpd

![](/files/-Mcu7m2hfp3Gt0kfyEDM)

Lets connect to FTP using Netcat

![](/files/-Mcu7xOm0Gx-dtaEBPjK)

![](/files/-Mcu8-cXhdYFxVRlmWBn)

Lets go to searchsploit and look for exploits on this particular version of FTP

![](/files/-Mcu8Awkwh0V8gAy8gyU)

![](/files/-Mcu8EnK-U5uv-_1dHBP)

Lets follow the steps they gave in the room to get an initial foothold on the machine

![](/files/-Mcu8ePRGvNj1t5JJRck)

![](/files/-Mcu9_0iIPFAp726JweM)

We are logged in, lets read the user flag.

![](/files/-Mcu9lyV25_d87v6HCB1)

## Privilege Escalation with Path Variable Manipulation

![](/files/-Mcu9zvDiwb_q2WHXN2d)

Lets follow the steps

![](/files/-McuAIYy_mt34kvv-Wl6)

![](/files/-McuANOneUXxaMQs7TPp)

![](/files/-McuAfEihNzAejemutKq)

![](/files/-McuAiroWBimLBTcSCw4)

![](/files/-McuAmHBlSIGljsG1Opw)

![](/files/-McuBLLNXemKsiTSfjEQ)