Lame

Summary

#

Lame is the oldest box on Hack The Box and still the cleanest demonstration of why version enumeration matters more than tooling. An outdated Samba service exposes a command-injection flaw that hands over a root shell directly — there is no privilege escalation step, because the vulnerable service is already running as root.

Recon

#

nmap -sC -sV -p- -oA nmap/lame 10.10.10.3

The interesting result is Samba on 139/445 reporting version 3.0.20. That version string is the whole box.

Foothold

#

Samba 3.0.20 is vulnerable to CVE-2007-2447 — the username map script option passes unsanitised input to a shell, so shell metacharacters in a username are executed on the host.

Because smbd runs as root here, exploiting it returns a root shell immediately. No escalation needed.

Lessons

#

The habit worth building from this box is reading version strings properly rather than reflexively reaching for a scanner. 3.0.20 is a specific, searchable fact; “Samba is open” is not.

It is also a useful reminder that “Easy” does not mean “there is a privesc step” — sometimes the initial service is already the highest privilege on the host, and looking for a second stage is wasted time.