> For the complete documentation index, see [llms.txt](https://cybersec.th4ntis.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybersec.th4ntis.com/hackthebox/walkthroughs/lame.md).

# Lame

## Initial Scan

```nmap
sudo nmap -T4 -v 10.129.111.164 -oA Lame
sudo nmap -T4 -p 21,22,139,445 -sV -v 10.129.111.164 -oA Lame
```

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FPoY9xZsOEorBlpFBH192%2Fimage.png?alt=media&amp;token=f42bd0fe-01ac-464c-851d-f96e5d2206a4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FhXeasmFUpmSAwS5q5z4Q%2Fimage.png?alt=media&amp;token=cefe45d2-8f76-407e-a76e-b3d5bc84050a" alt=""><figcaption></figcaption></figure>

## FTP

Anonymous Login is enabled

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F0hng0CfSfCZjuzF5Lvud%2Fimage.png?alt=media&amp;token=09cc95b9-ad53-4dd7-b3fc-bb6e86781b4d" alt=""><figcaption></figcaption></figure>

## SMB

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fp1QIdss7OoBpXD5odgmD%2Fimage.png?alt=media&amp;token=59475ac6-0882-4205-9822-9bf2968432c0" alt=""><figcaption></figcaption></figure>

&#x20;Only have access to tmp

&#x20;&#x20;

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FhEtjQzpeSWMtFQ8IRwPH%2Fimage.png?alt=media&amp;token=706e2608-9606-45db-a027-c274cccd9593" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fz23kLW11XV0ROCSphnEG%2Fimage.png?alt=media&amp;token=4d018b6f-0d5a-4bf2-824a-29308782b1c0" alt=""><figcaption></figcaption></figure>

## MSFconsole

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fn6aF3RRpWqOjb0kdiJlW%2Fimage.png?alt=media&amp;token=b4cfb2cb-f41e-4b16-8fbb-0ab5873bce36" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FhoHpXI7luMe5L0ilLeaq%2Fimage.png?alt=media&amp;token=12186de3-b3db-49c0-b49f-e0834abd536e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F2x2YqSHMdndetdHsn8kJ%2Fimage.png?alt=media&amp;token=86863c6e-7b04-4402-8947-092dc48520ca" alt=""><figcaption></figcaption></figure>

So it's not Vuln to MS17-010(EternalBlue). Check for SMB Version Vulnerabilities

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FkIZa1x9JiRLiYar5nCf5%2Fimage.png?alt=media&amp;token=8b46106b-ed27-4030-a0a5-6acccd278971" alt=""><figcaption></figcaption></figure>

[Rapid7 Document](https://www.rapid7.com/db/modules/exploit/multi/samba/usermap_script/)

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F0ESSpi5gQXlFS7AtDonT%2Fimage.png?alt=media&amp;token=d26afcab-618e-4a61-8df1-70eac7fc1460" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FU7K7uOoMjEpI52pTFMRl%2Fimage.png?alt=media&amp;token=afad6eaa-9c20-4a20-99e7-4f2524e04792" alt=""><figcaption></figcaption></figure>

User Flag: a6a83ea02ff14ca4aa497dad8c2f775

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fbca6zv3xJVdjlCL0xthL%2Fimage.png?alt=media&amp;token=ebd4137c-12e1-4182-97ef-772ad74fa158" alt=""><figcaption></figcaption></figure>

Root Flag: 162680cf1f47cde0affaecd104a59588

&#x20;

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FSnrmtKPZSznjWiPr0mDJ%2Fimage.png?alt=media&amp;token=a6357abe-2d4b-4456-a2e6-2926586abe67" alt=""><figcaption></figcaption></figure>
