Hack The Box (HTB) is an online platform that allows you to test your penetration testing skills. It contains several challenges that are constantly updated. Some of them are simulating real world scenarios and some of them lean more towards a CTF style of challenge.
Note. Only write-ups of retired HTB machines are allowed.
Granny, similarly to Grandpa, can be exploited using several different methods like the widely-exploited CVE-2017-7269. This vulnerability is trivial to exploit and granted immediate access to thousands of IIS servers around the globe when it became public knowledge.
We will use the following tools to pawn the box on a Kali Linux box:
- Local exploit suggester
Let's get started.
I add granny on the /etc/hosts file
Step 1 - Reconnaissance
The first step before exploiting a machine is to do a little bit of scanning and reconnaissance.
This is one of the most important parts as it will determine what you can try to exploit afterwards. It is always better to spend more time on this phase to get as much information as you can.
I will use Nmap (Network Mapper). Nmap is a free and open source utility for network discovery and security auditing. It uses raw IP packets to determine what hosts are available on the network, what services those hosts are offering, what operating systems they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.
There are many commands you can use with this tool to scan the network. If you want to learn more about it, you can have a look at the documentation here.
I use the following command to perform an intensive scan:
nmap -A -v granny.htb
-A: Enable OS detection, version detection, script scanning, and traceroute
-v: Increase verbosity level
granny.htb: hostname for the Granny box
If you find the results a little bit too overwhelming, you can do another command to get only the open ports.
We can see that there is only 1 open port:
Port 80, most often used by Hypertext Transfer Protocol (HTTP)
We know that the server is an IIS 6.0 from the http-server-header. Internet Information Services (IIS, formerly Internet Information Server) is an extensible web server software created by Microsoft for use with the Windows NT family. More info here.
IIS 6.0 (code name "Duct Tape"), included with Windows Server 2003 and Windows XP Professional x64 Edition, added support for IPv6 and included a new worker process model that increased security as well as reliability HTTP.sys was introduced in IIS 6.0 as an HTTP-specific protocol listener for HTTP requests
We can also see from the http-title that the website is "under construction" and that there is a http-webdav-scan with all the allowed methods.
I use another nmap script to try to get more information. The script sends an OPTIONS request which lists the dav type, server type, date and allowed methods. It then sends a PROPFIND request and tries to fetch exposed directories and internal IP addresses by doing pattern matching in the response body
nmap --script http-webdav-scan -p80 granny.htb
Here is more info on this script from the nmap website.
WebDAV or Web Distributed Authoring and Versioning (WebDAV) is an extension of the Hypertext Transfer Protocol that allows clients to perform remote Web content authoring operations. More info here.
We can see on the server support section that Microsoft's IIS has a WebDAV module.
I use davtest to check if I can upload files.
I use the following command:
davtest -url granny.htb
It doesn't look like I can upload files. I use Searchsploit to check if there is any known vulnerability on IIS 6.0. Searchsploit is a command line search tool for Exploit Database.
I use the following command:
searchsploit iis 6.0
I can get more details on the exploit with:
searchsploit -x 41738.py
The attack is based on a Return-oriented programming chain. Return-oriented programming (ROP) is a security exploit technique that allows an attacker to execute code in the presence of security defense such as executable space protection and code signing.
You can also check the Exploit Database to find the exploit.
The National Vulnerability Database,
and the Common Vulnerabilities and Exposure database are also worth checking.
There is one Metasploit module available.
Step 2 - Visiting the website
We don't see much when visiting the website. From the developer console, we can see it's powered by the ASP.NET framework
We will use Metasploit, which is a penetration testing framework that makes hacking simple. It's an essential tool for many attackers and defenders
I launch the Metasploit Framework on Kali and look for the command I should use to launch the exploit.
If I use this command
searchsploit iis 6.0
I get the same table that I had from the Terminal earlier.
If I type
search iis 6.0
I get 174 results.
The exploit I'm interested in is number 147 on this list.
If you want to get more information about the exploit, you can use the following command:
I use the following command to use the exploit:
I need to set up the options before launching the exploit. I check the options with
I set the RHOSTS with the following command:
set RHOSTS granny.htb
When I check again the options, I get this:
I check if the target is vulnerable with
Then I run the exploit with the command
And I get a Meterpreter session.
Here's the definition of Meterpreter from Offensive Security:
Meterpreter is an advanced, dynamically extensible payload that uses in-memory DLL injection stagers and is extended over the network at runtime. It communicates over the stager socket and provides a comprehensive client-side Ruby API. It features command history, tab completion, channels, and more.
You can read more about Meterpreter here.
Let's start by gathering some information.
getuid returns the real user ID of the calling process. The session I got doesn't seem to have enough privileges to run this command. Access is denied:
When this happens, I list the running processes with
and pick one running NT AUTHORITY\NETWORK SERVICE
I migrate to the process 792 with
Now when I check getuid, I get
Server username: NT AUTHORITY\NETWORK SERVICE
This is the session I got after migrating to another process
I type the following command to get a standard shell on the target system
I check who I am on the machine with the command
I get more information from the machine with
I navigate to C:\
then Documents and Settings with
cd "Documents and Settings"
I can see two users – Administrator and Lakis. I try to navigate to Lakis. Access is denied. Same for the administrator folder – which is expected as I don't have root access yet.
I exit the shell with the command
Step 3 - Using local exploit suggester
I run the local exploit suggester. The exploits are suggested based on the architecture and the platform the user has the shell open in, along with the available exploits in meterpreter.
I will use the MS14-070 exploit. I look for some more information on Metasploit with
As well as on the Rapid7 website
Step 4 - Using MS14-070 to perform privilege escalation
I put this session in the background with the command
I run the following command to use the exploit I found
I then check for the options of this exploit
I set the session with
set SESSION 1
I run the exploit with
The exploit succeeded, but I didn't get a shell back. I check the options
and set the LHOST to my IP with
set LHOST 10.10.14.36
You can check yours here.
I then run the exploit with
This confirms that the exploit has succeeded, but I still don't get a shell. I check the session with
I should have
Which is not the case now, so I go back to this session with
sessions -i 1
I check getuid and get NT AUTHORITY\SYSTEM back. I get a standard shell on the target system and check who am I on the machine. I get NT AUTHORITY\NETWORK SERVICE back, which is not what I want!
I exit this shell and check the processes. I can see that I have admin access on the machine. I just meed to migrate to another process, which I do with
I'm back to the standard shell on the target system. And when I check who I am on the machine, I'm finally an admin!
Step 5 - Looking for the user.txt flag
I navigate to the Lakis folder from Documents and Settings.
I can list all the files/folders with the following command
I then move to the Desktop
And I find the user flag! I can check the contents of the file with
Step 6 - Looking for the root.txt flag
Let's find the root flag now! I navigate up to Users and check in to the Administrator/Desktop folder. I find the flag!
I use the following command to see the content of the file
Congrats! You found both flags!
Please don’t hesitate to comment, ask questions or share with your friends :)
You can see more of my articles here.
You can follow me on Twitter or on LinkedIn.
And don't forget to #GetSecure, #BeSecure & #StaySecure!
Other Hack The Box articles