HTB Lame

HackTheBox: Lame Walkthrough

Welcome! It is time to look at the Lame machine on HackTheBox. I am making these walkthroughs to keep myself motivated to learn cyber security, and ensure that I remember the knowledge gained by playing HTB machines.

Machine URL: https://app.hackthebox.com/machines/Lame

Enumeration

Let's get started. Let's do a simple ICMP ping to see that the machine is running and that we have a connection:

We do. Let's continue doing a nmap scan:

nmap -sC -sV 10.10.10.3

nmap -sC -sV 10.10.10.3

This gives a message that the host might be down, so we will add the -Pn flag, as the host is likely blocking our ping probes.

We see a FTP service, in addition to SSH and SMB.

We can try logging into the FTP service as "Anonymous" user, but this shows an empty folder.

We can also see the version of the SMB service(3.0.20).

Exploitation

Let's search for some possible exploits by running:

searchsploit samba 3.0.20.

searchsploit samba 3.0.20.

This shows some exploits. Let's get some info on the first by running info 0.

This exactly mention version 3.0.20, so let's select this module by entering use 0. Follow this by showing the options (show options).

We can see that we need to set the RHOSTS, as well as make sure the LHOST is set correctly.

set RHOSTS 10.10.10.3

set RHOSTS 10.10.10.3

Then we can run the module by entering run.

We get a shell straight away:

Find the user flag at /home/makis:

And the root flag at /root.

User Flag:

cat /home/makis/user.txt

cat /home/makis/user.txt

Root Flag:

cat /root/root.txt

cat /root/root.txt

We are done! This was a very quick machine to hack!