< Back to All

Hack The Box: Granny

Granny -

Target enumeration:

OS: Windows


User: 700c5dc163014e22b3e408f8703f67d1

Root: aa4beed1c0584445ab463a6747bd06e9

Ports / Services / Software versions running

80/tcp open  http Microsoft IIS httpd 6.0 (Webdav enabled)

Vulnerability exploited:



Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.

Privilege escalation:



This module exploits improper object handling in the win32k.sys  kernel mode driver. This module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64.

Exploiting the host:


IIS 6.0 with webdav is vulnerable to a remote exploit and all of the methods are allowed unauthenticated.

Use the following exploit and set the options as follows:

Execute to get a meterpreter shell:

Background the session and run local exploit suggester against the host.

You will have several potential exploits to try.

Migrate to davcdata.exe

Use the following exploit and run it to get a system shell.

Now retrieve your flags