Metasploitable/Apache/DAV - Revision history

Admin: /* Tools That Don't Work */

2016-08-19T09:45:07Z

Tools That Don't Work

← Older revision		Revision as of 09:45, 19 August 2016
Line 200:		Line 200:
	=Tools That Don't Work=		=Tools That Don't Work=

	While cadaver combined with msfvenom works great for connecting to a WebDAV server and delivering a payload		While cadaver combined with msfvenom works great for connecting to a WebDAV server and delivering a payload, some tools did not work so great.

	==Davtest==		==Davtest==
Line 253:		Line 253:

	From the davtest scan, we saw a bunch of actions failed. I guess that means we need credentials to do anything. (?)		From the davtest scan, we saw a bunch of actions failed. I guess that means we need credentials to do anything. (?)



	==Metasploit Modules==		==Metasploit Modules==
Line 332:		Line 330:

	If you manage to find a writable directory, you can use it to get a remote shell: http://carnal0wnage.attackresearch.com/2010/05/more-with-metasploit-and-webdav.html		If you manage to find a writable directory, you can use it to get a remote shell: http://carnal0wnage.attackresearch.com/2010/05/more-with-metasploit-and-webdav.html



	=Flags=		=Flags=

	{{MSFlag}}		{{MSFlag}}

2016-03-29T23:30:32Z

Scan

← Older revision		Revision as of 23:30, 29 March 2016
Line 248:		Line 248:
	</pre>		</pre>

	This output is more helpful than the Metasploitable WebDAV scanner - ~~it shows us that the DAV server is open and running,~~ but ~~that~~ we can't do any actions. ~~This might be an authorization problem that we could get around with an exploit. And once we have access through WebDAV, being~~ able to ~~edit/add files on a remote server is a gateway to getting in and getting shells~~.		This output is more helpful than the Metasploitable WebDAV scanner - but still doesn't do what cadaver does. It says we can't do any actions. But cadaver was able to do all those things without credentials. (???)

	===Action Failures===		===Action Failures===

2016-03-29T23:06:05Z

Connect to Server

2016-03-29T23:04:49Z

Get a PHP Shell

← Older revision		Revision as of 23:04, 29 March 2016
Line 57:		Line 57:
	===Get a PHP Shell===		===Get a PHP Shell===

	In this example we'll use Metasploit to obtain a remote shell by creating a PHP file, then ~~uploading it~~ via WebDAV.		In this example we'll use Metasploit to obtain a remote shell. We will do this by creating a PHP file that will give us a remote shell using msfvenom, then upload the PHP script via WebDAV.

	===Create A Payload===		===Create A Payload===

2016-03-29T19:24:36Z

2016-03-29T19:20:09Z

Create A Payload

@@ Line 211: / Line 211: @@
 Payload size: 945 bytes
 </pre>
 =Flags=
 {{MSFlag}}

2016-03-29T19:16:40Z

Cadaver

@@ Line 147: / Line 147: @@
 Some background here: http://web.cs.sunyit.edu/~yanarej/Labs430/Lab_7__Exploitation.pdf
 =Flags=
 {{MSFlag}}

2016-03-29T18:56:18Z

Davtest

← Older revision		Revision as of 18:56, 29 March 2016
Line 90:		Line 90:

	You can also test out DAV using the <code>davtest</code> command line utility.		You can also test out DAV using the <code>davtest</code> command line utility.

			Also used here: https://www.youtube.com/watch?v=JoV1aSuy1XU&t=21m52s

	Check that you've got a copy:		Check that you've got a copy:
Line 136:		Line 138:

	From the davtest scan, we saw a bunch of actions failed. I guess that means we need credentials to do anything. (?)		From the davtest scan, we saw a bunch of actions failed. I guess that means we need credentials to do anything. (?)




			==Cadaver==

			Cadaver is a utility for dealing with WebDAV systems on the command line.

			Some background here: http://web.cs.sunyit.edu/~yanarej/Labs430/Lab_7__Exploitation.pdf

	=Flags=		=Flags=

	{{MSFlag}}		{{MSFlag}}

2016-03-29T18:55:02Z

Scan

← Older revision		Revision as of 18:55, 29 March 2016
Line 132:		Line 132:

	This output is more helpful than the Metasploitable WebDAV scanner - it shows us that the DAV server is open and running, but that we can't do any actions. This might be an authorization problem that we could get around with an exploit. And once we have access through WebDAV, being able to edit/add files on a remote server is a gateway to getting in and getting shells.		This output is more helpful than the Metasploitable WebDAV scanner - it shows us that the DAV server is open and running, but that we can't do any actions. This might be an authorization problem that we could get around with an exploit. And once we have access through WebDAV, being able to edit/add files on a remote server is a gateway to getting in and getting shells.

			===Action Failures===

			From the davtest scan, we saw a bunch of actions failed. I guess that means we need credentials to do anything. (?)

	=Flags=		=Flags=

	{{MSFlag}}		{{MSFlag}}

2016-03-29T18:52:51Z

What Is It?

@@ Line 4: / Line 4: @@
 The WebDAV protocol provides a framework for users to create, change and move documents on a server, typically a web server or web share.
 ==Metasploit Modules==
@@ Line 81: / Line 83: @@
 If you manage to find a writable directory, you can use it to get a remote shell: http://carnal0wnage.attackresearch.com/2010/05/more-with-metasploit-and-webdav.html
 =Flags=
 {{MSFlag}}