Links

Granny

Granny - 10.10.10.15

Target Enumeration:

OS: Windows
IP: 10.10.10.15
User: 700c5dc163014e22b3e408f8703f67d1
Root: aa4beed1c0584445ab463a6747bd06e9

Ports / Services / Software Versions Running

80/tcp open http Microsoft IIS httpd 6.0 (Webdav enabled)

Vulnerability Exploited:

iis_webdav_scstoragepathfromurl
https://cvedetails.com/cve/CVE-2017-7269/
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.

Privilege Escalation:

ms15_051_client_copy_image
This module exploits improper object handling in the win32k.sys kernel mode driver. This module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64.

Exploiting the host:

Nmap
IIS 6.0 with webdav is vulnerable to a remote exploit and all of the methods are allowed unauthenticated.
Use the following exploit and set the options as follows:
Execute to get a meterpreter shell:
Background the session and run local exploit suggester against the host.
You will have several potential exploits to try.
Migrate to davcdata.exe
Use the following exploit and run it to get a system shell.
Now retrive your flags
Root.txt