> For the complete documentation index, see [llms.txt](https://www.jdksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.jdksec.com/hack-the-box/granny.md).

# Granny

## Granny - 10.10.10.15

### Target Enumeration:

OS: Windows

IP: 10.10.10.15

User: 700c5dc163014e22b3e408f8703f67d1

Root: aa4beed1c0584445ab463a6747bd06e9

### Ports / Services / Software Versions Running

80/tcp open  http Microsoft IIS httpd 6.0 (Webdav enabled)

### Vulnerability Exploited:

iis\_webdav\_scstoragepathfromurl

<https://cvedetails.com/cve/CVE-2017-7269/>

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: \<http\://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.

### Privilege Escalation:

ms15\_051\_client\_copy\_image

<https://cvedetails.com/cve/CVE-2015-1701/>

This module exploits improper object handling in the win32k.sys  kernel mode driver. This module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64.

### Exploiting the host:

Nmap

![](https://lh4.googleusercontent.com/qjj1ja44Y3VumKv4AyPJY97BDVCpJ_GVDNW0Sv37EafwmAUjd5c38PcawL6EJgVSd2KZ2muoPESJ9CfB8tbUZ9pCJUUzy59Dwe5X69HjHXMet6jBFGJSefncEgikHcDf9-CjEp_Y)

IIS 6.0 with webdav is vulnerable to a remote exploit and all of the methods are allowed unauthenticated.

Use the following exploit and set the options as follows:

![](https://lh5.googleusercontent.com/E8rJ-1Mg88ga2o6ZP5ugUIJxwgBm48U1eyTWWLRZ6wYLiBuGd8CLSLHSDIwt3X3pPb6Pg23YQS69fKlHH1aO5_JGWa88tApupMmcs8LBiPvQENPbc_Y8kKJTDccBmEz902w14org)

Execute to get a meterpreter shell:

![](https://lh5.googleusercontent.com/BU1R0MwRnKeHlzjX2EziWD6u3Zmlldrf7ax7NQE3sXAVnd4FkPKrhxRuWMnTNPuxr299COJ5SHnHJPpfgXSIOA8st3wy-IcrylLNGzFg-yvc6vA19JG4Wf0bxhdJF8LHVlYJMhUN)

Background the session and run local exploit suggester against the host.

![](https://lh6.googleusercontent.com/lJvKgFgnZT0SxDyGhmQzB1gN_9Unb2HVgucYU0M9HlIu9vw35HteGuIDFetyAj_sRukVlDu-Oh_lGz0RK3lGaDiUWjkT7yoozLKsh7Ml2veL02NaQ6tgXnDdpmoSG1KHoDCnxBpm)

You will have several potential exploits to try.

![](https://lh6.googleusercontent.com/DttJOZFeabmaW75dbuvCzJptIHHiFttgZu5EC-xtHlPjCAulzou8Lz2bmIJZ8kDXrt9BvXMPDWd9Kef1SxZEu2Q8H4hxkUjt6YEuwdOiT7IdOnQzP7TKIUYET4svvRLgq-RTUABg)

Migrate to davcdata.exe

![](https://lh4.googleusercontent.com/7Beq0CJdLvpskKTOLE_rAUlcGTfz_m7BgVxqRqhMMqoAy0WKGU6t3-SnfVxEstzQl9lPs_MRZI7v3wn8mRHU_U5aJ8usP9bdbJ6Cra9PwoHyuN-X49gRp4czPymXkJA6Wu1tlFPd)

Use the following exploit and run it to get a system shell.

![](https://lh3.googleusercontent.com/hQGnNgzOxtgZHXJtSEYV74b4pne725-beVJmkl8NYrBy7i26UDar4-ivc24w6h9kLW6fvPQvG0EPAGMGouKP2qnEAF3PD_ZaEIx41oooPDlR78FIXqhzSNm00s69xgYRSMxE0ZoE)

Now retrive your flags

<div align="left"><img src="https://lh4.googleusercontent.com/S6HMlEsa6anA6Om8Ph32T7REKczY3GeOeJXbclOckDMa7AGO1SNY5PYDCnD33C6ogBJSZxkN0o2YyTH5Oav-jUkMSNJU4wc7v3roCVnQxoDxX5kNi3FSTqxWWxO7Wclw_hY8Xj3J" alt=""></div>

Root.txt

<div align="left"><img src="https://lh5.googleusercontent.com/58TKCnNfd-bciL3d_RLz5vhNx4fWKGAQ9jvEuqn9X5OkV8bTNPh54GRDpJaWF7J54gDybFcpZm60eYfTnmP4Q_InaSbZZo3UB6cHfJLpWhGtA0FRT3ztUU_j5Htb8SkWb-Zm63PW" alt=""></div>