UPLOAD EXPLOIT SUGGESTER TO LOCAL FULL

However, the existing script (41738.py) is poorly documented and in general seems to be of low quality.

UPLOAD EXPLOIT SUGGESTER TO LOCAL FULL

One of them is particularly interesting as a Remote Buffer Overflow usually gives us full abilities to execute code. A quick search on google/searchsploit reveals several existing vulnerabilities. Nmap has already given us the information that we are dealing with Microsoft IIS 6.0. Method 1 - Exploiting a Buffer Overflow in IIS 6.0 - WebDAV First, we gonna look at the one that’s most obvious. As we will see later, there are actually two ways to get initial access to the system. Initial FootholdĪs there are no direct hints on the website itself, we gonna look into something different. Here are the results of such a scan:Įven though there seem to be some interesting directories such as _private or _vti_bin, it turns out that all of them are either empty or not helpful at all.

So either the webserver is completely empty or there are some hidden directories which we first have to discover using a tool such as feroxbuster or gobuster. Looking at the website in the browser, we just see the default “Under Construction” message. Enumeration of Port 80 - Microsoft IIS 6.0 The only open port is port 80 which exposes Microsoft IIS 6.0.

Service Info: OS: Windows CPE: cpe:/o:microsoft:windows | Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK | Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH |_ Potentially risky methods: TRACE DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT | Supported Methods: OPTIONS TRACE GET HEAD DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT POST Rustscan -ulimit 5000 granny.htb - sV -sC -oN nmap_scanĨ0/tcp open http syn-ack Microsoft IIS httpd 6.0

Upload exploit suggester to local