Lame
Super Easy Linux HTB Box recommended for starters
Reconnaissance
As always, we start off with our Nmap port scan
As we can see on the scan, the following ports are open: TCP 21 (FTP) | TCP 22 (SSH) | TCP 139,445 (SAMBA) | TCP 3622 (DISTCCD)
Lets off start by checking if FTP allows Anonymous access
As we can see it allows us to connect with the Anonymous user but it does not contain any file... But we see that the version is outdated: vsftpd 2.3.4 so we will use searchsploit to enumerate exploits
As we can see this version of FTP is vulnerable to a Backdoor Command Execution but if we try to exploit it we won't be able in this case, so let's search for other methods
Let's try to enumerate TCP Port 445 running SAMBA using the tool smbmap
Exploitation
We see that the NULL Session has read and write permissions on the tmp share, we access but we don't seem to find anything useful, but after checking if the SAMBA version 3.0.20 was vulnerable, we find an exploit for it: CVE-2007-2447
We run the script and...
We get connection in our netcat listener on port 443 as the Root user and retrieve both of the flags
Thank you for reading and see you next time!
Last updated