Bounty Hack The Box Walkthrough (Without using Metasploit)

This walkthrough is for Granny box from Hack the Box which is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following:

• webdav MOVE options exploit to upload aspx file.
• Service user token impersonate for privilege escalation.

I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.