Grandpa

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Grandpa (Windows, attack surface: Microsoft IIS httpd 6.0 (80)). Foothold via the vulnerable entry point; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.14 --min-rate 1000

Enumeration highlights

• Detected OS: Windows.
• Open services: http (80).
• Scan used: nmap -p- -sVC 10.10.10.14 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.14 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-07 21:47 PDT
Nmap scan report for 10.10.10.14
Host is up (0.025s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 6.0
| http-webdav-scan: 
|   Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
|   Server Type: Microsoft-IIS/6.0
|   Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
|   WebDAV type: Unknown
|_  Server Date: Fri, 08 Sep 2023 04:49:20 GMT
| http-methods: 
|_  Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
|_http-server-header: Microsoft-IIS/6.0
|_http-title: Error
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 146.43 seconds

1. Based from the nmap result, the machine runs a web application and opening it, you shall realized it's the same webapp as the other machine challenge named "Grandma".

2. Dunno why HTB makes 2 same machine, but what comes to my mind, might be the intended solve is different.

3. Anyway I managed to solved this challenge using the SAME method as solving Grandma.

4. But maybe there's one little notes I forgot to write, to do privesc, I migrated first to davcdata.exe at session 1.

5. Migrating to davcdata.exe is a common tech to evade detection and improve privesc. Here's the example if I tried to do privesc without migrating the session to davcdata.exe:

6. Anyway, just like what I said before, the rest is the same as Granny machine.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.