[{"content":" What I built # Three refurbished mini PCs running Proxmox VE as a single cluster, which is where every lab VM and every deliberately-broken Windows domain now lives.\nWhy # The constraint was noise, not budget. The lab lives in the same room I work in, so anything with 40mm server fans was disqualified before price entered the conversation. Mini PCs idle nearly silent and pull little enough power that leaving the cluster on permanently is not an argument with anyone.\nBuild # Add photos by dropping them into this folder and referencing them relatively:\ncontent/homelab/proxmox-cluster/ ├── index.md ├── cover.jpg \u0026lt;- becomes the card thumbnail automatically └── rack.jpg What broke # Quorum. A three-node cluster tolerates exactly one node failing, and I learned what happens when you reboot two at once for updates: the survivor refuses to start anything, correctly, because it cannot prove it is not the minority side of a split. Obvious in hindsight, invisible at the time.\nWhat I would do differently # Separate the cluster\u0026rsquo;s own traffic from everything else from day one, rather than retrofitting it once the storage replication started interfering with the VMs it was supposed to be protecting.\n proxmox virtualization networking","date":"2026-08-21","externalUrl":null,"permalink":"/homelab/proxmox-cluster/","section":"Homelab","summary":"Refurbished mini PCs, one switch, and the quorum mistake that cost me an evening.","title":"Three-node Proxmox cluster","type":"homelab"},{"content":" Summary # Lame is the oldest box on Hack The Box and still the cleanest demonstration of why version enumeration matters more than tooling. An outdated Samba service exposes a command-injection flaw that hands over a root shell directly — there is no privilege escalation step, because the vulnerable service is already running as root.\nRecon # nmap -sC -sV -p- -oA nmap/lame 10.10.10.3 The interesting result is Samba on 139/445 reporting version 3.0.20. That version string is the whole box.\nFoothold # Samba 3.0.20 is vulnerable to CVE-2007-2447 — the username map script option passes unsanitised input to a shell, so shell metacharacters in a username are executed on the host.\nBecause smbd runs as root here, exploiting it returns a root shell immediately. No escalation needed.\nLessons # The habit worth building from this box is reading version strings properly rather than reflexively reaching for a scanner. 3.0.20 is a specific, searchable fact; \u0026ldquo;Samba is open\u0026rdquo; is not.\nIt is also a useful reminder that \u0026ldquo;Easy\u0026rdquo; does not mean \u0026ldquo;there is a privesc step\u0026rdquo; — sometimes the initial service is already the highest privilege on the host, and looking for a second stage is wasted time.\n samba cve-2007-2447 distcc enumeration Linux Easy","date":"2026-08-21","externalUrl":null,"permalink":"/writeups/lame/","section":"Writeups","summary":"Samba 3.0.20 command injection via CVE-2007-2447 — a root shell with no privilege escalation step.","title":"Lame","type":"writeups"},{"content":"I\u0026rsquo;m SirZak. I work in IT infrastructure and spend my evenings taking apart things that were not designed to come apart.\nThis site is where I write down what I learn — mostly so I stop solving the same problem twice. If something here saves you an afternoon, that was the point.\nWhat\u0026rsquo;s here # Writeups — retired Hack The Box machines. The reasoning, the dead ends, and what finally worked. Homelab — what I built and what it cost me to learn. Placeholder. The work-history section goes here — see the note below before filling it in. ","externalUrl":null,"permalink":"/about/","section":"SirZak","summary":"Who's writing.","title":"About","type":"page"}]