search

Grandpa

Reconnaissance:

http://10.10.10.14/ - Web frameworks: Microsoft ASP.NET - Web servers: IIS 6.0 - Operating systems: Windows Server

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.14 

80/tcp open  http    Microsoft IIS httpd 6.0
| http-webdav-scan: 
|   WebDAV type: Unknown
|   Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
|   Server Date: Sat, 16 Dec 2023 02:45:28 GMT
|   Server Type: Microsoft-IIS/6.0
|_  Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
|_http-title: Under Construction
| http-methods: 
|_  Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
|_http-server-header: Microsoft-IIS/6.0


┌──(kali💀kali)-[~]
└─$ sudo nmap -sU -O 10.10.10.14   

All 1000 scanned ports on 10.10.10.14 are in ignored states.

nmap found only HTTP listening on TCP 80

Gobuster:

Unfortunately, I can’t find anything in /images and it doesn’t list contents, and I just get a 403 from /_private.

Nikto:

WebDAV:

This reminds me a lot of Granny, and given all the WebDAV in the nmap output, I randavtest. Unlike in Granny, nothing is enabled:

Vulnerabilities:

Since IIS 6.0 is so old, I decided to look for vulnerabilities, and found some:

Microsoft IIS 6.0 is vulnerable to a remote buffer overflow.

Note: Several people I know have tried to solve this box without using Metasploit and have failed to because the shell you get back is too unstable. Therefore, I’ll be solving this box using Metasploit.

Foothold: Metasploit

Start up Metasploit.

Viewing the exploit on exploitdb we get a CVE #2017-7269. Let’s see if Metasploit has an exploit for it.

LogoMicrosoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer OverflowExploit Databasechevron-right

It does. Let’s switch to that exploit and configure the RHOST to the Grandpa IP address.

It appears the shell we are in however is a bit wonky:

If we run ps in Meterpreter, we can find list out running processes.

Process 1736 seems especially interesting because it is running as NT AUTHORITY\NETWORK SERVICE. We can migrate to that process using the migrate command:

Cool. Now we’ll need to focus on escalating our privileges to get the flags:

Lets go ahead and background this session and import the local_exploit_suggester module to check for privilege escalation vectors for us:

Nice, the module found quite a few possible vectors.

I’m most interested in trying exploit/windows/local/ms14_070_tcpip_ioctl.

I can search for and use this module and then set the session as well as my lhost IP address:

Foothold: Shell

LogoGitHub - g0rx/iis6-exploit-2017-CVE-2017-7269: iis6 exploit 2017 CVE-2017-7269GitHubchevron-right
Logoiis6-exploit-2017-CVE-2017-7269/iis6 reverse shell at master · g0rx/iis6-exploit-2017-CVE-2017-7269GitHubchevron-right

At my listener:

I eventually found this script. I didn’t have to update it at all, and running it gave a shell:

Sometimes this script too would fail, if the box wasn’t in a clean start. When doing buffer overflow exploits, it’s a good idea to start from a clean state if possible (ie reset the box).

Interestingly, I didn’t have access to user.txt at this point. There was one user, Harry:

Privilege Escalation

To run any exploits, I’ll need a place I can write on Grandpa. Many of my go-tos failed In the system root, there’s an unusual directory, wmpub:

icacles shows that as well:

That Userss can WD decodes to write data/add files.

systeminfo:

While you don’t see it in newer HTB, for these original hosts, kernel exploits were often the intended path, and it’s definitely something that will come up in OSCP. To check, I’ll start with a systeminfo:

I can then drop that into a file and use Windows Exploit Suggester to see what exploits might work.

First, update:

Now pass it the new database and the systeminfo output:

Going from this list to a shell is often a lot of googling, guessing, and trial and error. I’ll reduce the list with the following criteria:

  • Not interested in Metasploit.

  • Looking (at least to start) for exploits against Windows itself, not IE or MsSQL.

  • I like to start with ones that I can find a pre-compiled exe. That’s not a great idea for real work, but easiest for HTB / OSCP.

  • The exe has to create a new process that calls back or can return a shell in the same window. You’ll find a lot of these have exes that open a new shell as SYSTEM, which isn’t useful at all for me.

No Success I tried a lot off this list, but none with success. This is normal for this kind of thing. It’s frustrating, and normal. One tip I’d throw out for anyone doing OSCP - keep a list of exploits that have binaries that fit the descriptions above and where they work. I used to have one, but can’t find it anymore. Something like this is a really good start.

I went back to enumerating, and checked privs:

SEImpersonalPrivilege is one I know to look out for. For modern boxes, that means a potato exploit (juicy, lonely, rotten). But for 2003, it’s better to start with churrasco.

churrasco:

I grabbed the binary from the Churrasco GitHub. I ran smbserver.py share . on my local machine to open an SMB share named share with both nc.exe and churrasco.exe in that directory:

LogoGitHub - Re4son/Churrasco: Changes for Visual Studio 2013GitHubchevron-right
PreviousArticNextSilo

Last updated