Granny

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Granny (Windows, attack surface: Microsoft IIS httpd 6.0 (80)). Foothold via buffer overflow; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.15 --min-rate 1000

Enumeration highlights

• Detected OS: Windows.
• Open services: http (80).
• Scan used: nmap -p- -sVC 10.10.10.15 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.15 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-07 20:57 PDT
Nmap scan report for granny.htb (10.10.10.15)
Host is up (0.024s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 6.0
| http-methods: 
|_  Potentially risky methods: TRACE DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT
| http-webdav-scan: 
|   WebDAV type: Unknown
|   Server Date: Fri, 08 Sep 2023 03:59:06 GMT
|   Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
|   Server Type: Microsoft-IIS/6.0
|_  Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK
|_http-server-header: Microsoft-IIS/6.0
|_http-title: Under Construction
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 125.23 seconds

1. Based from the nmap resulst, the machine runs a web application.

2. We got the service version too --> Microsoft IIS httpd 6.0.

3. Did a small research about it on the internet or metasploit, there's many CVE documentation.

4. Let's try this one --> Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow.

5. But interestingly, it seems we need to do privesc to open Lakis directory.

6. Let's run local_exploit_suggester.

meterpreter > run post/multi/recon/local_exploit_suggester

1. Great, let's show description so we can analyze it more.

2. Seems there's many option to do privesc. But what comes to my interest is this module:

A vulnerability within the Microsoft TCP/IP protocol driver tcpip.sys can allow a local attacker to trigger a NULL pointer dereference by using a specially crafted IOCTL. This flaw can be abused to elevate privileges to SYSTEM. 

1. Let's use that.

GOT ROOT PRIVILEGE

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.