search

Grandpa Writeup w/ Metasploit

hashtag
Reconnaissance

Run the nmapAutomatoarrow-up-rightr script to enumerate open ports and services running on those ports.

  • All: Runs all the scans consecutively.

We get back the following result.

We have one port open.

  • Port 80: running Microsoft IIS httpd 6.0

Before we move on to enumeration, let’s make some mental notes about the scan results.

  • The only port that is open is port 80 so this will definitely be our point of entry. The port is running an outdated version of Microsoft IIS and is using the WebDAV protocol. One thing that pops out right away is the number of allowed HTTP methods. As mentioned in the scan results, these methods could potentially allow you to add, delete and move files on the web server.

hashtag
Enumeration

Visit the web application in the browser.

Look into the directories/files that gobuster found. We don’t find anything useful. Next, let’s test the allowed HTTP methods.

The scan shows that the HTTP PUT method is allowed. This could potentially give us the ability to save files on the web server. Since this is an IIS Microsoft web server, the type of files it executes are ASP and ASPX. So let’s check if we’re allowed to upload these file extensions.

We get back the following result.

Unlike the Granny boxarrow-up-right, there are restrictions put in place that don’t allow us to upload files, so this won’t be the way we gain initial access to the box. Next, let’s run searchsploit on the web server version.

Microsoft IIS 6.0 is vulnerable to a remote buffer overflow.

Note: Several people I know have tried to solve this box without using Metasploit and have failed to because the shell you get back is too unstable. Therefore, I’ll be solving this box using Metasploit.

hashtag
Initial Foothold

Start up Metasploit.

Viewing the exploit on exploitdbarrow-up-right we get a CVE # 2017–7269arrow-up-right. Let’s see if Metasploit has an exploit for it.

It does. Let’s switch to that exploit and configure the RHOST to the Grandpa IP address.

Then run the exploit.

We get a shell! However, when we run the “getuid” command, we get an operation failed error. This is because we’re running in an unstable process. To fix that, let’s see which processes are running on the box and migrate to one that is running with the same privileges that the meterpreter session is running with.

Let’s migrate to process # 2172 and try running the “getuid” command again.

Perfect! We have a stable working meterpreter session. We’re running with low privileges, so we’ll need to escalate our privileges to SYSTEM.

hashtag
Privilege Escalation

Background the meterpreter session.

We’ll use the Local Exploit Suggester module to check the box for local vulnerabilities.

Run the Local Exploit Suggester.

We’ll use MS14–070 to escalate privileges.

The exploit was successful! Let’s go back and enter our meterpreter session and view our privilege level.

We’re SYSTEM! Grab the user.txt and root.txt flags.

hashtag
Lessons Learned

We gained initial access to the machine and escalated privileges by exploiting known vulnerabilities that had patches available. So it goes without saying, you should always update your software!

PreviousForest Writeup w/o MetasploitNextGranny Writeup w/o and w/ Metasploit

Last updated