> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/htb/oscp-like-boxes/lame.md). # Lame ### Scanning

### Enumerating FTP

From the above Nmap scan results, it is evident that anonymous FTP login is allowed on the host. Using the credentials (anonymous:), I managed to anonymously log into FTP server.

### Exploiting SMB

Searching the Samba version online, I found that it could be vulnerable to [CVE-2007-2447](https://github.com/amriunix/CVE-2007-2447). After cloning the git repository, I set up a Netcat listener on port 4444 and ran the usermap\_script.py against the SMB server.

As seen from the above screenshot, I obtained a root shell from the listening netcat host.

After stabilizing the shell, I obtained both user and root flags User flag: 2cf83f41a92929ac635b7aafe5f54448 Root flag: 0c52c534d9d73482e7da0423cf4cf43b ### Exploiting Distccd

Searching for the Distccd v1 exploits, I came across [CVE-2004-2687](https://gist.github.com/DarkCoderSc/4dbf6229a93e75c3bdf6b467e67a9855). Next, I downloaded the exploit and set up a netcat listener on port 4446. Afterwards, I ran the distccd\_rce\_CVE-2004-2687.py exploit script.

From the above screenshot, I managed to obtain a user shell and was able to view the user flag.

### Privilege Escalation I transferred linpeas.sh to the victim's machine by setting up a python SimpleHTTPServer and using wget to obtain the file from the attacker's machine.

Next, I used the `chmod +x linpeas.sh` to enable execute privileges for the user. Next, I ran linpeas.sh.

From the output, Nmap has SUID bit set. Searching it on GTFObins, I found that interactive mode on Nmap could be used to execute privileged shell commands.

From above, I managed to spawn a root shell using Nmap when the SUID bit is set. Lastly, I have obtained the root flag: 0c52c534d9d73482e7da0423cf4cf43b