Granny Writeup
As I’m continuing to work through older boxes, and using the same methodology as Grandpa Box, I came to Granny, another easy Windows host involving webshells.
Vulnerability Exploited: Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow (CVE-2017-7269)
System Vulnerable: 10.10.10.15
Vulnerability Explanation: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
Vulnerability Fix: Update the used version of Microsoft IIS httpd 6.0 version
Privilege Escalation Vulnerability: Microsoft Windows Server 2003 - Token Kidnapping Local Privilege Escalation. Basically, if you can run code under any service in Win2k3 then you can own Windows, this is because Windows services accounts can impersonate. Other process (not services) that can impersonate are IIS 6 worker processes so if you can run code from an ASP .NET or classic ASP web application then you can own Windows too.
Vulnerability Fix: If you provide shared hosting services, then I would recommend to not allow users to run this kind of code from ASP.
Severity: Critical
An initial Nmap scan revealed the HTTP server on port 80 with Microsoft IIS httpd 6.0 version.
The Microsoft IIS httpd 6.0 initial page on port 80.
Searching for public exploits for Microsoft IIS httpd 6.0 using searchsploit
https://www.exploit-db.com/exploits/41738
https://nvd.nist.gov/vuln/detail/CVE-2017-7269
The modified version of the exploit to open a reverse shell can be found on the following link:
https://github.com/g0rx/iis6-exploit-2017-CVE-2017-7269/blob/master/iis6%20reverse%20shell
Launch a local listener using nc command and execute the exploit:
A reverse shell received as NT AUTHORITY\NETWORK SERVICE
Privilege Escalation:
Check the OS version using systeminfo command:
Search for public exploit using searchsploit on base of the OS Name and OS Version found on the previous systeminfo.
https://www.exploit-db.com/exploits/6705
Download the exploit from https://github.com/Re4son/Churrasco, and copy the nc.exe software to the working directory.
Then start a local ftp server on the local machine using Python to transfer the files to the victim machine:
Download the churrasco.exe file on the victim machine as follow:
Then download the nc.exe using the same method:
Launch a nc listener on the attacker machine using port 9002 and execute the following command:
A reverse shell received as NT AUTHORITY\SYSTEM
user.txt
root.txt
Lessons Learned
We gained initial access to the machine and escalated privileges by exploiting known vulnerabilities that had patches available. So it goes without saying, you should always update your software!
Last updated