Hack The Box
Hack The Box: Grandpa Walkthrough
Grandpa exploits an IIS 6 WebDAV buffer overflow and a Windows privilege-escalation flaw to reach SYSTEM.
Recon & Enumeration
Use nmap to scan for open ports and services:
Visit the site.
Hop into searchsploit to look for exploits affecting IIS 6.0 WebDAV.
We will conduct a Google search to explore alternative versions of the first exploit in the results of searchsploit as it failed to work with me here.
We will go with the Python script here opens in a new tab and have a look at it to gain insights into the prerequisites for this exploit.
Download it to our attack box.
Add the shebang line to the location of our python interpreter.
Launch our listener.
Launching the exploit.
And we have a shell.
We are going to need to escalate our privileges here as we have limited access rights, we can check which privileges have been assigned to this account.
Also have a look at the system's information.
Having SEImpersonalPrivilege enabled on the target machine and running Windows 2003 with IIS 6.0, means that we are lucky to use Token Kidnapping exploit opens in a new tab and have a system shell.
Download the binary file of the exploit here opens in a new tab to our attack box.
We will create a "temp" directory within the C partition of the target machine.
As "certutil.exe" failed to download the exploit via an HTTP server, we will deploy an SMB server from our attack box's working directory to transfer "Netcat" and "Churrasco.exe".
Copy "Netcat" and "Churrasco.exe".
Launch a listener on our attack box.
Proceed with executing the command below to establish a connection back to our attack box using "Netcat".
And we get a system shell on our listener.
