Lame

Tue, 10 Jun 2025 07:07:07 +0100

Recon

NMAP

└─$ nmap -sC -sV 10.10.10.3 -p-  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-10 17:11 EDT
Stats: 0:01:13 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 31.33% done; ETC: 17:14 (0:02:38 remaining)
Nmap scan report for 10.10.10.3
Host is up (0.048s latency).
Not shown: 65530 filtered tcp ports (no-response)
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.14.39
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey:                                                        
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)        
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)        
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
3632/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel        
                                                                      
Host script results:                                                  
| smb-security-mode:                                                  
|   account_used: guest                                               
|   authentication_level: user                                        
|   challenge_response: supported                                     
|_  message_signing: disabled (dangerous, but default)                
| smb-os-discovery:                                                   
|   OS: Unix (Samba 3.0.20-Debian)                                    
|   Computer name: lame                                               
|   NetBIOS computer name:                                            
|   Domain name: hackthebox.gr                                        
|   FQDN: lame.hackthebox.gr                                          
|_  System time: 2025-06-10T17:15:23-04:00                            
|_smb2-time: Protocol negotiation failed (SMB2)                       
|_clock-skew: mean: 2h00m33s, deviation: 2h49m44s, median: 31s

21 ftp

	|-> anonymous login allowed
	|-> SearchSploit:

vsftpd 2.3.4 - Backdoor Command Execution                        | unix/remote/49757.py
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)           | unix/remote/17491.rb

22 ssh

|-> SearchSploit:

OpenSSH 2.3 < 7.7 - Username Enumeration                         | linux/remote/45233.py
OpenSSH 2.3 < 7.7 - Username Enumeration (PoC)                   | linux/remote/45210.py
OpenSSH < 6.6 SFTP (x64) - Command Execution                     | linux_x86-64/remote/45000.c
OpenSSH < 6.6 SFTP - Command Execution                           | linux/remote/45001.py
OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix | linux/local/40962.txt
OpenSSH < 7.4 - agent Protocol Arbitrary Library Loading         | linux/remote/40963.txt
OpenSSH < 7.7 - User Enumeration (2)                             | linux/remote/45939.py

139 netbios-ssn Samba 3.x-4.x

445 netbios-ssn Samba 3.0.20

|-> SearchSploit:

Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Comma | unix/remote/16320.rb
Samba 3.0.21 < 3.0.24 - LSA trans names Heap Overflow ( | linux/remote/9950.rb
Samba 3.0.24 (Linux) - 'lsa_io_trans_names' Heap Overfl | linux/remote/16859.rb
Samba 3.0.24 (Solaris) - 'lsa_io_trans_names' Heap Over | solaris/remote/16329.rb
Samba 3.0.27a - 'send_mailslot()' Remote Buffer Overflo | linux/dos/4732.c
Samba 3.0.29 (Client) - 'receive_smb_raw()' Buffer Over | multiple/dos/5712.pl
Samba < 3.0.20 - Remote Heap Overflow                   | linux/remote/7701.txt
Samba < 3.6.2 (x86) - Denial of Service (PoC)           | linux_x86/dos/36741.py

3632 distccd V1

Exploitation

Samba 3.0.20 has an RCE exploit that can be run in metasploit.
After that we get a root shell and the box is PWNed

Blueprint

Fri, 21 Jun 2024 07:07:07 +0100

New Vocabulary

LM hash (LanMan Hash)
- a compromised password hashing function that was the primary hash that Microsoft LAN manager and Windows used to store passwords
NTLM (New Technology LAN Manager)
- a suite of Microsoft security protocols intended to provide authentication, integrity, and confidentiality to users. NTLM is a challenge-response authentication protocol used to authenticate a client to a resource on an Active Directory domain or a server running a stand-alone Windows computer.

Accessing MariaDB (unauthorized)

mysql -h 10.10.120.20 -u root
- Not allowed to connect to this MariaDB server from IP

Exploit osCommerce 2.3.4

https://www.exploit-db.com/exploits/44374

Metasploit on

Lame

Recon

NMAP

21 ftp

22 ssh

139 netbios-ssn Samba 3.x-4.x

445 netbios-ssn Samba 3.0.20

3632 distccd V1

Exploitation

Blueprint

New Vocabulary

Accessing MariaDB (unauthorized)

Exploit osCommerce 2.3.4