# Lame ## Enumeration I ran an extensive nmap scan: `sudo nmap -A -p- ` ``` Starting Nmap 7.92 ( https://nmap.org ) at 2021-10-05 09:48 CEST Nmap scan report for 10.10.10.3 Host is up (0.19s latency). Not shown: 996 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 | ftp-syst: | STAT: | FTP server status: | Connected to 10.10.16.2 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | vsFTPd 2.3.4 - secure, fast, stable |_End of status |_ftp-anon: Anonymous FTP login allowed (FTP code 230) 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) | ssh-hostkey: | 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA) |_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 2.6.23 (92%), Belkin N300 WAP (Linux 2.6.30) (92%), Control4 HC-300 home controller (92%), Dell Integrated Remote Access Controller (iDRAC5) (92%), Dell Integrated Remote Access Controller (iDRAC6) (92%), Linksys WET54GS5 WAP, Tranzeo TR-CPQ-19f WAP, or Xerox WorkCentre Pro 265 printer (92%), Linux 2.4.21 - 2.4.31 (likely embedded) (92%), Citrix XenServer 5.5 (Linux 2.6.18) (92%), Linux 2.6.18 (ClarkConnect 4.3 Enterprise Edition) (92%), Linux 2.6.8 - 2.6.30 (92%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Host script results: | smb-security-mode: | account_used: | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) |_smb2-time: Protocol negotiation failed (SMB2) | smb-os-discovery: | OS: Unix (Samba 3.0.20-Debian) | Computer name: lame | NetBIOS computer name: | Domain name: hackthebox.gr | FQDN: lame.hackthebox.gr |_ System time: 2021-10-05T03:51:17-04:00 |_clock-skew: mean: 2h01m51s, deviation: 2h49m43s, median: 1m50s TRACEROUTE (using port 445/tcp) HOP RTT ADDRESS 1 194.07 ms 10.10.16.1 2 273.26 ms 10.10.10.3 ``` The anonymous FTP login was a dead end as there was only an empty folder. Running further enumeration on the smb port shew very interesting results though: ``` | LAME\user (RID: 3002) | Full name: just a user,111,, | Flags: Normal user account | LAME\msfadmin (RID: 3000) | Full name: msfadmin,,, | Flags: Normal user account | smb-ls: Volume \\10.10.10.3\tmp | SIZE TIME FILENAME | 2021-10-05T08:12:02 . | 2020-10-31T06:33:58 .. | 2021-10-05T07:47:13 vmware-root | 0 2021-10-05T07:48:19 5563.jsvc_up | 1600 2021-10-05T07:47:13 vgauthsvclog.txt.0 | \\10.10.10.3\ADMIN$: | Type: STYPE_IPC | Comment: IPC Service (lame server (Samba 3.0.20-Debian)) | Users: 1 | Max Users: | Path: C:\tmp | Anonymous access: | \\10.10.10.3\IPC$: | Type: STYPE_IPC | Comment: IPC Service (lame server (Samba 3.0.20-Debian)) | Users: 1 | Max Users: | Path: C:\tmp | Anonymous access: READ/WRITE | \\10.10.10.3\opt: | Type: STYPE_DISKTREE | Comment: | Users: 1 | Max Users: | Path: C:\tmp | Anonymous access: | \\10.10.10.3\print$: | Type: STYPE_DISKTREE | Comment: Printer Drivers | Users: 1 | Max Users: | Path: C:\var\lib\samba\printers | Anonymous access: | \\10.10.10.3\tmp: | Type: STYPE_DISKTREE | Comment: oh noes! | Users: 1 | Max Users: | Path: C:\tmp |_ Anonymous access: READ/WRITE ``` ## SMB Exploits w/ Metasploit Searching for a useful module in msfconsole, I tried multi/samba/usermap\_script, which worked. Then I found a CVE for the smb verison on the server, Samba 3.0.20-Debia. The according metasploit module gave me a root shell immediately. This could have been done with a PoC from searchsploit or exploitdb. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://shibudocs.gitbook.io/htb-writeups/boxes-easy/lame.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.