Kenobi is useful because it makes a familiar lesson visible: a foothold is not a finish line. Each stage only gives enough evidence to choose the next, least invasive authorised test. The route joins an anonymous SMB share, a vulnerable ProFTPD copy feature, an NFS export, an SSH identity boundary, and a SUID program that resolves a command through an unsafe search path.
This is an original learning companion. It uses the official room and primary technical references to explain the reasoning, not to publish a copied answer trail. Examples are bounded to the active lab, while flags, credentials, key material, hashes and live target details remain redacted.
01 · The attack model: trace trust, not tricks
The room's official learning goals already name the important surfaces: Samba, ProFTPD, NFS, and a SUID binary. Treat that as a map of boundaries. SMB may reveal information that changes a version hypothesis; the FTP service may move a sensitive artefact; NFS may expose the destination; SSH validates one user boundary; and the SUID program asks whether a privileged process resolves programs safely.
HINT 01 SERVICES
Do not start with an exploit name. Ask which service reveals the facts needed to make one narrow version decision.
HINT 02 EXPORTS
An NFS export is a file boundary. Inspect what is exposed and why before treating it as a route to a user session.
HINT 03 PRIVILEGE
When a SUID binary invokes another program, discover whether it uses an absolute path and a sanitised environment.
02 · Build a service inventory before choosing a branch
Start against the private address assigned to your running room. Keep it in a variable so notes and later commands remain legible. The scan is an inventory, not an instruction to touch every service.
export LAB_IP="<tryhackme-assigned-ip>"
mkdir -p nmap
nmap -sC -sV -Pn -oA nmap/kenobi "$LAB_IP"-sV asks services for version information, -sC uses Nmap's default scripts, and -oA preserves evidence in three useful formats. The room exposes several services, including SMB, FTP and RPC-related services. That combination matters because a file transfer clue has more value when you can ask whether a server export makes the destination observable.
Representative result, not an observed scan:
139/tcp netbios-ssn 445/tcp microsoft-ds
111/tcp rpcbind 2049/tcp nfs
21/tcp ftp 22/tcp ssh03 · SMB: use the anonymous share as evidence
With SMB exposed, enumerate only what the lab permits. First learn whether shares are available and whether a null session is accepted. Then inspect the anonymous share instead of downloading every reachable file.
nmap -p 139,445 --script smb-enum-shares.nse,smb-enum-users.nse "$LAB_IP"
smbclient "//$LAB_IP/anonymous" -N
# inside smbclient: lsThe important artefact in Kenobi is operational context: it links an account, an SSH-key creation event, and the ProFTPD service. That is a better next-step lead than an unbounded wordlist. Write down the exposed ProFTPD version, then validate whether the relevant module and behaviour belong to the lab.
An unauthenticated share can expose more than documents. Installation notes, log fragments and key-generation records help an attacker connect services into a chain. Disable anonymous access unless a business requirement is explicit, then minimise its content and audit every read.
04 · ProFTPD: validate the copy-control hypothesis narrowly
CVE-2015-3306 describes a flaw in ProFTPD 1.3.5's mod_copy control commands. The relevant lesson is not “an FTP server is old”. It is that a file-copy control must enforce both the source and destination authorisation model. In the room, the module permits an unauthenticated client to copy an existing file to a chosen destination.
Confirm the service banner and room context first. If they match, make one minimal, authorised attempt to place only the room's designated identity artefact into the room's known export path. Do not use this pattern outside the TryHackMe machine.
# Lab-only control-channel shape. Keep actual paths and key material private.
printf 'SITE CPFR <room-source-file>\r\nSITE CPTO <room-exported-destination>\r\n' | nc "$LAB_IP" 21What proves the hypothesis is a success response followed by evidence that the intended destination contains the expected file. Do not turn the step into bulk file collection. If the response is negative, return to the service version and module evidence instead of repeating requests blindly.
Remove or update the vulnerable module, require authentication for sensitive file operations, and constrain both source and destination paths. The correct fix is server-side authorisation, not merely hiding the FTP banner.
05 · NFS makes the copied artefact observable
Remote Procedure Call services are a clue to ask an NFS-specific question: which file systems has the server exported? Linux documents that /etc/exports defines the paths and client access policy exposed by an NFS server. In this lab, the export is the bridge between an FTP-controlled destination and a local, readable artefact.
showmount -e "$LAB_IP"
mkdir -p /tmp/kenobi-nfs
sudo mount "$LAB_IP:<exported-path>" /tmp/kenobi-nfs
find /tmp/kenobi-nfs -maxdepth 2 -type f -lsMount only the export the lab exposes and copy the single artefact needed for the next authorised boundary. Private keys deserve careful handling even in a lab: protect their local permissions, avoid placing them in shell history, and remove local copies when you have finished the exercise.
install -m 600 /tmp/kenobi-nfs/<lab-key-file> ./kenobi_lab_key
ssh -i ./kenobi_lab_key <lab-user>@"$LAB_IP"A successful SSH login proves a user boundary, not administrative control. Immediately establish the local model: identity, groups, interesting SUID programs, scheduled tasks, writable directories and explicit elevation rules. Do not assume that a valid key is a root path.
06 · SUID PATH review: when a helper trusts a name
Kenobi's final lesson is a privileged helper whose implementation looks up a command by name rather than by a fixed, trusted path. The SUID bit runs an executable with the file owner's effective identity. If that executable uses an attacker-influenced PATH to find another program, the trusted process may select the wrong executable.
find / -perm -4000 -type f 2>/dev/null
strings <suid-helper-path> | grep -Ei 'curl|wget|ping|system|exec'
getcap -r /usr/bin /usr/local/bin 2>/dev/nullThe decisive observation is an unqualified command name in a privileged program. A controlled lab proof uses a harmless wrapper located in a temporary directory placed first in PATH, verifies the effective context once, then stops. Do not publish or reuse a privileged shell payload, and do not run it outside the room.
# Controlled lab proof pattern: replace the command name only in the room.
mkdir -p /tmp/kenobi-path-check
printf '#!/bin/sh\nid\n' > /tmp/kenobi-path-check/<command-called-by-helper>
chmod 700 /tmp/kenobi-path-check/<command-called-by-helper>
PATH=/tmp/kenobi-path-check:$PATH <suid-helper-path>MITRE classifies this pattern as CWE-426, Untrusted Search Path. The durable fix is to use an absolute executable path, reset the process environment, and avoid invoking a shell from privileged code. Filtering a few characters is not a fix for an authority boundary.
07 · Decision log: when a branch does not behave as expected
The fastest way to learn from Kenobi is to keep a small decision log. For every stage, record the observation, the claim it supports, the least invasive check, and the condition that tells you to stop. This prevents the common habit of replacing uncertainty with a larger scan or a louder payload.
SMB does not open anonymously
An authentication error is still useful evidence. Check the exact share name from the enumeration output, then distinguish a bad path from a refused null session. Do not pivot into credential guessing. In the room, the anonymous share is an intended evidence source; on a real assessment, a refused session normally means the unauthenticated branch has ended.
The FTP version looks close but not exact
A version string is not proof of an enabled module, a vulnerable build, or the same configuration described by a CVE. Stop when the banner or module evidence does not match the room's premise. In a production engagement, you would report the version exposure separately, look for a vendor-supported fix path, and seek permission before any controlled validation.
The NFS mount fails
Return to the export list. An export can be read-only, restricted to particular clients, or exposed under a different path than the one you inferred. The correct move is to compare the server's advertised export with the destination used in the lab, not to change server options or attempt arbitrary paths. A mount failure is a boundary behaving as designed until evidence says otherwise.
The recovered key is refused by SSH
First check the local file mode and the username indicated by the room artefact. SSH commonly rejects private keys that are too broadly readable. If the key still fails, treat that as a failed hypothesis and revisit the NFS artefact path. Do not password-spray or re-use any lab value on another service.
The SUID helper does not produce the expected result
Do not keep adding wrappers. Inspect the executable's strings and execution behaviour, then ask whether it calls a command by absolute path, resets its environment, or has a different privilege context than expected. The key lesson is recognition: a SUID bit alone is not a finding, and an unsafe PATH matters only when a privileged process actually uses it to resolve a dependency.
When the evidence does not support the next step, stop, document the mismatch, and return to the model. That discipline reduces noise in a lab and prevents unsafe escalation in real authorised work.
08 · Findings, fixes and detection opportunities
| Finding | Why it matters | Fix | Detection |
|---|---|---|---|
| Anonymous SMB information exposure | Operational artefacts reveal account and service relationships. | Disable anonymous access, minimise shared content and enforce ACL review. | Log anonymous share reads and alert on unusual enumeration patterns. |
ProFTPD mod_copy copy-control failure | Unauthenticated file copying can bridge service boundaries. | Update or remove the affected module; authorise source and destination paths. | Alert on SITE CPFR and SITE CPTO commands, especially before login. |
| Broad NFS export exposure | An exported path can make a sensitive file transfer retrievable. | Export only needed directories to explicit clients with least privilege. | Record mountd and export access; review new clients and mount attempts. |
| SUID helper uses an untrusted command search path | A lower-privileged user can influence a privileged program's dependency. | Use full paths, clear the environment and remove unnecessary SUID bits. | Alert on SUID executions with unusual PATH values or executables from temporary directories. |
The chain is resilient because each weak boundary preserves enough information or control for the next. Defenders should validate the repair as a chain too: removing the vulnerable FTP module does not fix the anonymous share; hard-coding a path does not fix a broad NFS export.
09 · Recognition cues for the next lab
- Service adjacency matters. An SMB note plus a version banner plus an NFS export is more meaningful than any one finding alone.
- Validate version hypotheses once. A banner is a lead, not a licence for repeated exploit attempts.
- Keys are sensitive evidence. Handle a lab key as though it were real, even when the room makes it disposable.
- Privilege review is broader than sudo. Search SUID, capabilities, scheduled tasks, writable service files and environment-dependent helpers together.
- Trust inputs, not file names. A privileged process is responsible for every program, path and environment value it consumes.
References and source notes
Frequently asked questions
What is the attack model this writeup uses?
Trace trust, not tricks. Each stage is a decision: which service to inspect, which claim to test and which boundary the evidence actually supports, from SMB artefacts to a SUID PATH failure.
Why is ProFTPD mod_copy worth validating narrowly?
A copy-control feature can move files between locations when passed arguments are trusted. The lesson is to test the feature in isolation rather than assume any single service leads to root.
What should a defender fix first?
Remove anonymous shares that leak data, disable unused FTP modules, and review SUID binaries whose helpers resolve executables by name from a user-writable path.