admin2099/penetration-testing-assessment-23-04-2026Penetration testing assessment of a vulnerable IIS 6.0 WebDAV server, demonstrating reconnaissance, enumeration, exploitation (CVE-2017-7269), and privilege escalation to SYSTEM, along with risk analysis and remediation strategies.
This project demonstrates a complete penetration testing lifecycle performed on a vulnerable target system. The assessment follows a structured approach including reconnaissance, scanning, enumeration, exploitation, and post-exploitation.
The target system is a Windows Server 2003 R2 machine running Microsoft IIS 6.0 with WebDAV enabled, which exposes it to critical vulnerabilities.
| Parameter | Value |
|---|---|
| Target IP | 10.129.3.70 |
| OS | Windows Server 2003 R2 |
| Web Server | Microsoft IIS 6.0 |
| Port | 80 (HTTP) |
| Vulnerability | CVE-2017-7269 |
Network interfaces and connectivity were verified using basic commands such as ip a and ping.
Nmap scans revealed that only port 80 was open on the target system.
The Metasploit module below was used: exploit/windows/iis/iis_webdav_scstoragepathfromurl
This exploited CVE-2017-7269 and established a Meterpreter session.
nc.exe and churrasco.exe| Risk Level | Description |
|---|---|
| Critical | Remote code execution and privilege escalation |
| High | Misconfigured services and exposed attack surface |
| Medium | Directory exposure and weak configurations |
The penetration test demonstrated that the target system is highly vulnerable due to outdated software and insecure configurations. Attackers can easily exploit these weaknesses to gain full system access. Immediate remediation is necessary to secure the environment.
Debayan Das
Cybersecurity Analyst