✒️
Report
  • Introduction
  • MCC 2022
    • ThisIsSoEasy1
    • Hermoso
  • Vulnhub
    • Kioptrix
      • Level 1.1
      • Level 1.2
      • Level 1.3
      • Level 1.4
    • Symfonos
      • Symfonos 1
      • Symfonos 2
      • Symfonos 3
      • Symfonos 4
    • DC
      • DC6
      • DC9
    • Sar1
    • Toppo 1
    • Prime 1
    • Bob 1.0.1
    • Escalate Linux < NOT FINISH >
    • Djinn 1
    • Golden Eye 1
    • Hackme1
    • Stapler 1
    • DerpNStink
    • Lin Security
    • W34KN3SS
  • Symfonos 5 <NOT WORKING>
  • Hackthebox
    • Delivery (Easy)
    • Spectra (Easy)
    • Script Kiddie (Easy)
    • Armageddon (Easy)
    • Love (Easy)
    • Knife (Easy)
    • Traverxec (Easy)
    • Bastion (Easy)
    • Heist (Easy)
    • Shocker (Easy)
    • Active (Easy)
    • The Notebook (Medium)
    • Paper (Easy)
    • Jerry (Easy)
    • Networked (Easy)
    • Swagshop (Easy) - Not Working
    • Lame (Easy)
Powered by GitBook
On this page
  • Enumeration
  • Nmap

Was this helpful?

  1. Hackthebox

Lame (Easy)

Enumeration

Nmap

nmap -sC -sV -oA nmap/Lame -Pn 10.129.90.142
Starting Nmap 7.92 ( https://nmap.org ) at 2022-06-10 02:52 EDT
Nmap scan report for 10.129.90.142
Host is up (0.19s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.14.93
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 2h00m19s, deviation: 2h49m43s, median: 18s
|_smb2-time: Protocol negotiation failed (SMB2)
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name: 
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2022-06-10T02:52:54-04:00

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 66.02 seconds

By using the script we found, we can get a reverse shell from it!

Congrats!

PreviousSwagshop (Easy) - Not Working

Last updated 2 years ago

Was this helpful?

From the nmap result, there is a samba vulnerability present in this machine. By googling it, we can get an working exploit

here