# Granny

## Granny - 10.10.10.15

### Target Enumeration:

OS: Windows

IP: 10.10.10.15

User: 700c5dc163014e22b3e408f8703f67d1

Root: aa4beed1c0584445ab463a6747bd06e9

### Ports / Services / Software Versions Running

80/tcp open  http Microsoft IIS httpd 6.0 (Webdav enabled)

### Vulnerability Exploited:

iis\_webdav\_scstoragepathfromurl

<https://cvedetails.com/cve/CVE-2017-7269/>

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: \<http\://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.

### Privilege Escalation:

ms15\_051\_client\_copy\_image

<https://cvedetails.com/cve/CVE-2015-1701/>

This module exploits improper object handling in the win32k.sys  kernel mode driver. This module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64.

### Exploiting the host:

Nmap

![](https://lh4.googleusercontent.com/qjj1ja44Y3VumKv4AyPJY97BDVCpJ_GVDNW0Sv37EafwmAUjd5c38PcawL6EJgVSd2KZ2muoPESJ9CfB8tbUZ9pCJUUzy59Dwe5X69HjHXMet6jBFGJSefncEgikHcDf9-CjEp_Y)

IIS 6.0 with webdav is vulnerable to a remote exploit and all of the methods are allowed unauthenticated.

Use the following exploit and set the options as follows:

![](https://lh5.googleusercontent.com/E8rJ-1Mg88ga2o6ZP5ugUIJxwgBm48U1eyTWWLRZ6wYLiBuGd8CLSLHSDIwt3X3pPb6Pg23YQS69fKlHH1aO5_JGWa88tApupMmcs8LBiPvQENPbc_Y8kKJTDccBmEz902w14org)

Execute to get a meterpreter shell:

![](https://lh5.googleusercontent.com/BU1R0MwRnKeHlzjX2EziWD6u3Zmlldrf7ax7NQE3sXAVnd4FkPKrhxRuWMnTNPuxr299COJ5SHnHJPpfgXSIOA8st3wy-IcrylLNGzFg-yvc6vA19JG4Wf0bxhdJF8LHVlYJMhUN)

Background the session and run local exploit suggester against the host.

![](https://lh6.googleusercontent.com/lJvKgFgnZT0SxDyGhmQzB1gN_9Unb2HVgucYU0M9HlIu9vw35HteGuIDFetyAj_sRukVlDu-Oh_lGz0RK3lGaDiUWjkT7yoozLKsh7Ml2veL02NaQ6tgXnDdpmoSG1KHoDCnxBpm)

You will have several potential exploits to try.

![](https://lh6.googleusercontent.com/DttJOZFeabmaW75dbuvCzJptIHHiFttgZu5EC-xtHlPjCAulzou8Lz2bmIJZ8kDXrt9BvXMPDWd9Kef1SxZEu2Q8H4hxkUjt6YEuwdOiT7IdOnQzP7TKIUYET4svvRLgq-RTUABg)

Migrate to davcdata.exe

![](https://lh4.googleusercontent.com/7Beq0CJdLvpskKTOLE_rAUlcGTfz_m7BgVxqRqhMMqoAy0WKGU6t3-SnfVxEstzQl9lPs_MRZI7v3wn8mRHU_U5aJ8usP9bdbJ6Cra9PwoHyuN-X49gRp4czPymXkJA6Wu1tlFPd)

Use the following exploit and run it to get a system shell.

![](https://lh3.googleusercontent.com/hQGnNgzOxtgZHXJtSEYV74b4pne725-beVJmkl8NYrBy7i26UDar4-ivc24w6h9kLW6fvPQvG0EPAGMGouKP2qnEAF3PD_ZaEIx41oooPDlR78FIXqhzSNm00s69xgYRSMxE0ZoE)

Now retrive your flags

<div align="left"><img src="https://lh4.googleusercontent.com/S6HMlEsa6anA6Om8Ph32T7REKczY3GeOeJXbclOckDMa7AGO1SNY5PYDCnD33C6ogBJSZxkN0o2YyTH5Oav-jUkMSNJU4wc7v3roCVnQxoDxX5kNi3FSTqxWWxO7Wclw_hY8Xj3J" alt=""></div>

Root.txt

<div align="left"><img src="https://lh5.googleusercontent.com/58TKCnNfd-bciL3d_RLz5vhNx4fWKGAQ9jvEuqn9X5OkV8bTNPh54GRDpJaWF7J54gDybFcpZm60eYfTnmP4Q_InaSbZZo3UB6cHfJLpWhGtA0FRT3ztUU_j5Htb8SkWb-Zm63PW" alt=""></div>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.jdksec.com/hack-the-box/granny.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.