Lame Write-up
Machine HTB Linux Easy
Lame is an easy Linux machine, requiring only one exploit to obtain root access. It was the first machine published on Hack The Box and was often the first machine for new users prior to its retirement.
🔍 Task 1 — How many of the
nmaptop 1000 TCP ports are open on the remote host?
By executing the following command sudo nmap -sT --top-ports 1000 10.129.49.158 it was possible to identify the open TCP ports on the target machine.
The answer is 4
🔍 Task 2— What version of VSFTPd is running on Lame?
To identify the versions of the services running on the target system, a more detailed nmap scan was performed using service and script detection -sCV . The -sV performs service version detection.
The answer is 2.3.4
📁 Task 4 — There is a famous backdoor in VSFTPd version 2.3.4, and a Metasploit module to exploit it. Does that exploit work here?
An attempt was made to exploit this vulnerability using the available Metasploit module; however, the exploit did not succeed against the target system.
This indicates that, despite the service version matching a vulnerable release, the backdoor is either not present, not accessible, or has been mitigated on this particular instance.
Get AuraSec’s stories in your inbox
Join Medium for free to get updates from this writer.
The answer is no
🔍 Task 5 — What version of Samba is running on Lame? Give the numbers up to but not including “-Debian”.
Based on the results of the nmap service version scan, the version of the Samba service running on the target system was identified.
The answer is 3.0.20
📁 Task 6 — What 2007 CVE allows for remote code execution in this version of Samba via shell metacharacters involving the
SamrChangePasswordfunction when the "username map script" option is enabled insmb.conf?
The answer is CVE-2007–2447
🔓 Task 7 — Exploiting CVE-2007–2447 returns a shell as which user?
After launching Metasploit (msfconsole), a search was performed for the module associated with CVE-2007–2447.
Before executing the exploit, the required parameters (such as RHOST, RPORT, and LHOST) were properly configured. Once the exploit was run, a shell was successfully obtained on the target system.
The answer is root
🏴 User Flag — Submit the flag located in the makis user’s home directory.
The answer is 4e6<REDCATED>1d2
🚩 Root Flag — Submit the flag located in root’s home directory.
The answer is 6f5<REDACTED>f6e
