HackTheBox - Grandpa/Granny
Please note that the exploitation process for both the granny and grandpa machines is pretty much identical. This writeup will only cover the steps to gain SYSTEM level access on the grandpa machine, but you can reproduce the same steps to get the same SYSTEM level access on the granny machine.
Machine release date: April 12, 2017
Active Ports
sudo nmap -p80 -sC -sV -oA nmap/full-tcp-version 10.10.10.14
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-03 12:22 EDT
Nmap scan report for 10.10.10.14
Host is up (0.028s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 6.0
| http-methods:
|_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
|_http-server-header: Microsoft-IIS/6.0
|_http-title: Under Construction
| http-webdav-scan:
| Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
| WebDAV type: Unknown
| Server Date: Thu, 03 Sep 2020 16:24:53 GMT
| Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
|_ Server Type: Microsoft-IIS/6.0
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Vulnerability Discovery
As seen in the nmap scan above, Microsoft IIS httpd 6.0 is extremely outdated, so I went ahead and googled for some known exploits against it.
It turns out that some research showed that the vulnerability disclosure date was shortly after this box was released.
