Lame — HackTheBox Write-up (L-E)
Lame is an easy Linux box released way back in March 2017 that involves exploiting a SMB vulnerability on the machine.
Reconnaissance
Let’s check for open ports and running services using nmap
We have 4 ports open; 21
, 22
, 139
, and 445
.
Exploring the allowed anonymous login via FTP doesn’t really give us much. The only other interesting ports are the two smb ports.
Exploitation and Privilege Escalation
Searching around, we’ll see that Samba smbd 3.0.20
has a username map script
command execution vulnerability. Let’s use that on Metasploit.
It worked!
Let’s stabilize our connection by spawning a python interactive shell
Since we’re already a root user, finding both the user and root flag is just a matter of directly reading the files.