HTB GRANDPA WALKTHROUGH

HackTheBox is an excellent platform for various pen-testers to increase their testing skills and knowledge.
Machine Level -Easy
Machine Name -Grandpa
Machine OS -Windows
Machine IP -10.10.10.14
Tools:
Nmap -Nmap is a fantastic tools for scanning the open ports, services and OS detection. You can use other tools other than nmap (which ever you are more comfortable with ) like masscan, SPARTA etc to scan for open ports.
Metasploit -One of the most common and widely used tool by pen-testers to launch exploits, it is maintained by Rapid 7 . Many books are available to understand the features of this tool.
Method :
Scanning the machine is the first step(i.e. Enumeration). We use the following nmap command,

sudo nmap -T4 -p- -A 10.10.10.14

The command  scans for all ports(-p-) with threads speed 4 (-T4) and also gives you version details  (-A).

So, only port 80 is open. Its says its running Microsoft IIS 6.0 , but first lets visit the victim's IP and see what's there.

There's nothing to do on the page. It says its under constructor.
Let's search for Microsoft IIS 6.0 in the searchsploit.

There are some results, but we are interested in remote execution, so lets search for this Remote Buffer Overflow on google.

There is a module by Rapid7, let's visit this.

Copy the module's exploit.
Fire up your msfconsole and use the exploit.

See for its options, we see that we need to provide the rhosts Use the command

set rhosts 10.10.10.14

Run the exploit.

Exploit successful, we got a meterpreter shell. Lets see system information and what access we have in the shell.

So, the access is denied. We need to do privilege escalation to gain access.

Lets background the session .
Now, let's start interaction with the session (or you can directly use the suggester to see possible exploits available.)
Use the command ps to see for processes running.

See for the various process with privileges. If you are lucky you can get Authority access for some machines.

We see we have  NT Authority\Network Service as a user . Lets migrate to it.
Use command migrate 1836

We are NT Authority\Network Service. But we need to be Authority .
Lets background the session and use suggester

Set the session to 1 and run the suggester.

Several exploit are there. Use any one. Use the command :

use exploit/windows/local/ms15_051_client_copy_image

Use the exploit and see for options available.

Set the session to 1 and run the exploit.

Exploit successful. Now we are NT Authority\System.

Grab the root flag.

Grab the user flag.
That's all for this machine.
Thanks!