Grandpa — HTB Writeup | The Hack Sparrow

Executive summary — Grandpa is a «museum-piece» Easy Windows box: an IIS 6.0 (Windows Server 2003) with WebDAV vulnerable to CVE-2017-7269 gives RCE as NETWORK SERVICE; and being an ancient Windows, we escalate to SYSTEM abusing SeImpersonatePrivilege with Churrasco (MS09-012 Token Kidnapping). A WebDAV RCE → NETWORK SERVICE → SYSTEM path, with a detour through a restricted Meterpreter session and a writable staging folder.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.95.233`

Attack map

[80] Microsoft IIS 6.0 (Windows Server 2003) · WebDAV
   │  CVE-2017-7269 — ScStoragePathFromUrl overflow (WebDAV) → RCE via Metasploit
   ▼
[SHELL]  NT AUTHORITY\NETWORK SERVICE  (limited Meterpreter — stdapi restricted)
   │  whoami /priv → SeImpersonatePrivilege: Enabled
   │  writable C:\wmpub\ + nc.exe + churrasco.exe → MS09-012 Token Kidnapping
   ▼
[SYSTEM]  NT AUTHORITY\SYSTEM

1. Reconnaissance

nmap -sC -sV -Pn 10.129.95.233

80/tcp  open  http  Microsoft IIS httpd 6.0

The clue: IIS 6.0 belongs to the Windows Server 2003/XP era — ancient by any standard. Its WebDAV service carries CVE-2017-7269, one of the most classic unauthenticated RCEs ever found in IIS, and a single open port 80 is the entire attack surface here.

Resumen ejecutivo — Grandpa es una Windows Easy «de museo»: un IIS 6.0 (Windows Server 2003) con WebDAV vulnerable a CVE-2017-7269 da RCE como NETWORK SERVICE; y al ser un Windows tan antiguo, se escala a SYSTEM abusando de SeImpersonatePrivilege con Churrasco (MS09-012 Token Kidnapping). Un recorrido WebDAV RCE → NETWORK SERVICE → SYSTEM, con una parada en una sesión Meterpreter restringida y una carpeta de trabajo con permisos de escritura.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.95.233`

Mapa del ataque

[80] Microsoft IIS 6.0 (Windows Server 2003) · WebDAV
   │  CVE-2017-7269 — desbordamiento en ScStoragePathFromUrl (WebDAV) → RCE via Metasploit
   ▼
[SHELL]  NT AUTHORITY\NETWORK SERVICE  (Meterpreter limitado — stdapi restringido)
   │  whoami /priv → SeImpersonatePrivilege: Enabled
   │  C:\wmpub\ con permiso de escritura + nc.exe + churrasco.exe → MS09-012 Token Kidnapping
   ▼
[SYSTEM]  NT AUTHORITY\SYSTEM

1. Reconocimiento

nmap -sC -sV -Pn 10.129.95.233

80/tcp  open  http  Microsoft IIS httpd 6.0

La pista: IIS 6.0 pertenece a la era de Windows Server 2003/XP — antiquísimo para cualquier estándar actual. Su servicio WebDAV arrastra CVE-2017-7269, una de las RCEs sin autenticación más clásicas jamás encontradas en IIS, y un único puerto 80 abierto es toda la superficie de ataque aquí.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.