Granny - 10.10.10.15
Ports / Services / Software versions running
80/tcp open http Microsoft IIS httpd 6.0 (Webdav enabled)
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.
This module exploits improper object handling in the win32k.sys kernel mode driver. This module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64.
Exploiting the host:
IIS 6.0 with webdav is vulnerable to a remote exploit and all of the methods are allowed unauthenticated.
Use the following exploit and set the options as follows:
Execute to get a meterpreter shell:
Background the session and run local exploit suggester against the host.
You will have several potential exploits to try.
Migrate to davcdata.exe
Use the following exploit and run it to get a system shell.
Now retrieve your flags