✅Granny (Easy)

Lesson Learn

Report-Penetration

Vulnerable Exploit: Misconfigure on Method

System Vulnerable: 10.10.10.15

Vulnerability Explanation: The machine is misconfigured on Method which could allow us to upload revershell and gain initial foothold.

Privilege Escalation Vulnerability: Out of dated System

Vulnerability Fix: Restricted method and apply patch to the system

Severity: High

Step to Compromise the Host:

Reconnaissance

Enumeration

Port 80 Microsoft-IIS/6.0

By going through port 80, we just see simple webpage. That's the only entry point.

Let start gobuster for to find hidden directory and run nikto scan.

Get back to our nmap scan, we found the application is using webdav protocol. There are a lot of method protocol allow.

We can use davtest for this exploit. As we notice that for microsoft support asp and aspx but it doesn't allow. But it allow PUT method which we could upload file.

Davtest

We could try to upload file with PUT method.

Let change the file type by MOVE method.

By this we can upload our reverse shell in txt file extension first then we can change to aspx.

Exploitation

Generating the window reverse shell payload and change file name from .aspx to .txt first.

Let start our netcat listener on port 4444.

We can upload our payload via PUT method and change it from .txt to .aspx. But it's error.

We can try again and add --data-binary.

Privilege Escalation

We can run systeminfo and save those information into a file systeminfo.txt.

We can run windows-exploit-suggester for checking vulnerable.

Window 2003 - Token Kidnapping

We have tried a bunch of manual exploit but it doesn't work. Let start manual enumerating on the machine. We see the machine is window server 2003.

Checking the privilege, we see SeImpersonatePrivilege is enabled.

Search for public exploit, we found one Local Privilege Escalation.

Proof of concept code: https://www.exploit-db.com/exploits/6705

Let download the exploit code and start SMB Server to share exploit folder.

On our victim machine connect and execute the exploit code.

PreviousForest (Easy)NextGranpa (Easy)

Last updated