# Lame

This is my write-up for the machine Lame on Hack The Box located at: <https://app.hackthebox.com/machines/Lame>.

{% hint style="info" %}
I am a beginner at penetration testing, so I will be referencing the Official Hack The Box Walk-through for this machine.
{% endhint %}

rustscan: `rustscan -a 10.10.10.3`

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-402e91c5e60bd5f018cde609eacd49c79f465989%2Fimage.png?alt=media)

I saw that port 21 was open. I was able to login to the anonymous user:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-f5c7d951212f1730519b2e50833dc8d1e7ed3c5e%2Fimage.png?alt=media)

There was nothing in the folder. My guess is that I will have to upload a reverse shell on the system and then trigger it in order to get a connection to the system. I then ran `enum4linux -a 10.10.10.3`, which showed me this:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-077d7b9dab399fb4b43c7d8b0a18d85d2d6f7d2b%2Fimage.png?alt=media)

Running `smbclient -L <IP_ADDRESS>` shows the same information:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-7c31ace0be5b1ad3da295b9cd9bf77d2fd4a3db1%2Fimage.png?alt=media)

Looking in the **tmp** directory did not give anything useful:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-85ae5438a326c7b833b5b1bd17806cea3ff69f66%2Fimage.png?alt=media)

From playing around in the **SMB** system, I noticed that I have access to the **tmp** and **IPC$** user. Neither of those had gotten me information that I can work off of. I looked at the write-up to see what I missed. There was a exploit on Metasploit that got you root:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-a7bba7bba66e170111086f5d02a30ccd756ee3fc%2Fimage.png?alt=media)

Now I have to look for the flags:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-66b6e0ee3c220e77e6279d084476706b5be9e5d7%2Fimage.png?alt=media)
