Granny & Grandpa

Port Scanning and General Enumeration (Nmap, Nikto)

• Reading/Resources
  • Nmap manual

Initial scan showed just 80 (HTTP) open

Gobuster returned nothing. Nikto had a bunch to say, but I’m starting to see a trend. WebDav in the nmap scan, WebDav in the nikto scan

Things we know

• IIS 6.0
• WebDav is enabled

---

Access (searchsploit, metasploit)

• Reading/Resources
  • searchsploit
  • metasploit

Searchsploit:

WebDav remote buffer overflow? There’s a python script, but I couldn’t get it to work. Let’s check out metasploit

That’s what we’re looking for!

And we’re in!

---

Privesc (metasploit, kitrap0d)

• Reading/Resources
  • metasploit
  • kitrap0d

Running into issues with my shell and running post exploits. Something about insufficient privileges so I tried migrating to a different process

new process seems to work

use post/multi/recon/local_exploit_suggester

Let’s try kitrap0d

That got us there