# HackTheBox - Granny


![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622008331356/dViUtj4sX.png)

Starting with nmap-automator

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622008430663/OGRDLH6fP.png)

We have only port 80 open

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622008476854/bByIOyQsi.png)

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622008560151/jdjtuR5Ga.png)

We will create a php reverse shell using msfvenom and upload it using a tool cadaver

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622008953118/_qMu0rwpM.png)

we get an error

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622008984996/lM5O1tTU5.png)

We also see that it has microsoft's IIS 6.0 running which is pretty outdated

We have a `Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow`

which we can use to get remote code execution

Running the exploit we get a shell of service account

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622009317176/o0trc4NKh.png)

`whoami /priv`

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622009389010/jA6ImIruK.png)

The `SeImpersonatePrivilege` enabled which we can exploit using the churrasco.exe

Running Impacket-SMBServer to get files in the windows machine

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622009505163/dZEeYzDvb.png)

We are getting the same error as before in the Grandpa box

So we have to use metasploit as the last resort

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622183633149/RA_lw9crD.png)

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622183713887/5-7zZltIS.png)

Running the metasploit local exploit suggestor

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622184625956/7INfs6H3q.png)

Migrating the process

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1622184171329/elGakgFXS.png)

Here we see that after running the `windows/local/ms15_051_client_copy_image` module from metasploit

We finally get the nt\authority