Grandpa HTB — user and system pwn

Grandpa HTB — user and system pwn

Let’s jump in from the perspective of a scriptkiddy

Nmap scan reveals an open HTTP port

PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 6.0
|_http-title: Under Construction
|_http-server-header: Microsoft-IIS/6.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT POST MOVE MKCOL PROPPATCH
|_  Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
| http-webdav-scan: 
|   Server Type: Microsoft-IIS/6.0 …

construction copy delete head header htb http httpd iis infosec lock microsoft options perspective scan search server service state system tcp trace under unlock webdav