Metasploitable/Apache/DAV: Difference between revisions
From charlesreid1
| Line 4: | Line 4: | ||
The WebDAV protocol provides a framework for users to create, change and move documents on a server, typically a web server or web share. | The WebDAV protocol provides a framework for users to create, change and move documents on a server, typically a web server or web share. | ||
==Metasploit Modules== | |||
To check for WebDAV, you can use a couple of different modules: | |||
===webdav scanner=== | |||
Scan for WebDAV: | Scan for WebDAV: | ||
| Line 17: | Line 23: | ||
Looks like it is turned off... | Looks like it is turned off... | ||
==webdav internal ip=== | |||
we can use another scanner module to check for internal IPs with WebDAV enabled: | |||
<pre> | |||
msf > use auxiliary/scanner/http/webdav_internal_ip | |||
msf auxiliary(webdav_internal_ip) > show options | |||
Module options (auxiliary/scanner/http/webdav_internal_ip): | |||
Name Current Setting Required Description | |||
---- --------------- -------- ----------- | |||
PATH / yes Path to use | |||
Proxies no A proxy chain of format type:host:port[,type:host:port][...] | |||
RHOSTS yes The target address range or CIDR identifier | |||
RPORT 80 yes The target port | |||
THREADS 1 yes The number of concurrent threads | |||
VHOST no HTTP server virtual host | |||
msf auxiliary(webdav_internal_ip) > set RHOSTS 10.0.0.27 | |||
RHOSTS => 10.0.0.27 | |||
msf auxiliary(webdav_internal_ip) > run | |||
[*] Scanned 1 of 1 hosts (100% complete) | |||
[*] Auxiliary module execution completed | |||
msf auxiliary(webdav_internal_ip) > | |||
</pre> | |||
===webdav website content=== | |||
Similarly with the next scanner: | |||
<pre> | |||
msf auxiliary(webdav_website_content) > use auxiliary/scanner/http/webdav_website_content | |||
msf auxiliary(webdav_website_content) > show options | |||
Module options (auxiliary/scanner/http/webdav_website_content): | |||
Name Current Setting Required Description | |||
---- --------------- -------- ----------- | |||
PATH / yes Path to use | |||
Proxies no A proxy chain of format type:host:port[,type:host:port][...] | |||
RHOSTS yes The target address range or CIDR identifier | |||
RPORT 80 yes The target port | |||
THREADS 1 yes The number of concurrent threads | |||
VHOST no HTTP server virtual host | |||
msf auxiliary(webdav_website_content) > set RHOSTS 10.0.0.27 | |||
RHOSTS => 10.0.0.27 | |||
msf auxiliary(webdav_website_content) > run | |||
[*] Scanned 1 of 1 hosts (100% complete) | |||
[*] Auxiliary module execution completed | |||
msf auxiliary(webdav_website_content) > | |||
</pre> | |||
If you manage to find a writable directory, you can use it to get a remote shell: http://carnal0wnage.attackresearch.com/2010/05/more-with-metasploit-and-webdav.html | |||
=Flags= | =Flags= | ||
{{MSFlag}} | {{MSFlag}} | ||
Revision as of 05:00, 29 March 2016
What Is It?
WebDAV stands for Web Distributed Authoring and Versioning.
The WebDAV protocol provides a framework for users to create, change and move documents on a server, typically a web server or web share.
Metasploit Modules
To check for WebDAV, you can use a couple of different modules:
webdav scanner
Scan for WebDAV:
msf auxiliary(webdav_scanner) > run [*] 10.0.0.27 (Apache/2.2.8 (Ubuntu) DAV/2) WebDAV disabled. [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(webdav_scanner) >
Looks like it is turned off...
webdav internal ip=
we can use another scanner module to check for internal IPs with WebDAV enabled:
msf > use auxiliary/scanner/http/webdav_internal_ip msf auxiliary(webdav_internal_ip) > show options Module options (auxiliary/scanner/http/webdav_internal_ip): Name Current Setting Required Description ---- --------------- -------- ----------- PATH / yes Path to use Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target address range or CIDR identifier RPORT 80 yes The target port THREADS 1 yes The number of concurrent threads VHOST no HTTP server virtual host msf auxiliary(webdav_internal_ip) > set RHOSTS 10.0.0.27 RHOSTS => 10.0.0.27 msf auxiliary(webdav_internal_ip) > run [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(webdav_internal_ip) >
webdav website content
Similarly with the next scanner:
msf auxiliary(webdav_website_content) > use auxiliary/scanner/http/webdav_website_content msf auxiliary(webdav_website_content) > show options Module options (auxiliary/scanner/http/webdav_website_content): Name Current Setting Required Description ---- --------------- -------- ----------- PATH / yes Path to use Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target address range or CIDR identifier RPORT 80 yes The target port THREADS 1 yes The number of concurrent threads VHOST no HTTP server virtual host msf auxiliary(webdav_website_content) > set RHOSTS 10.0.0.27 RHOSTS => 10.0.0.27 msf auxiliary(webdav_website_content) > run [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(webdav_website_content) >
If you manage to find a writable directory, you can use it to get a remote shell: http://carnal0wnage.attackresearch.com/2010/05/more-with-metasploit-and-webdav.html
Flags
 |
Metasploit any and all resources related to metasploit on this wiki
Category:Metasploit - pages labeled with the "Metasploit" category label MSF/Wordlists - wordlists that come bundled with Metasploit MSFVenom - msfvenom is used to craft payloads Meterpreter - the shell you'll have when you use MSF to craft a remote shell payload.
Category:Security · Category:Metasploit · Category:Kali
|
|
Metasploitable: The Red Team Metasploitable is a virtual machine with baked-in vulnerabilities, designed to teach Metasploit. This set of articles discusses the RED TEAM's tools and routes of attack.
Exploiting MySQL with Metasploit: Metasploitable/MySQL Exploiting PostgreSQL with Metasploit: Metasploitable/Postgres
Exploiting VSFTP Backdoor: Metasploitable/VSFTP SSH Penetration by Brute Force: Metasploitable/SSH/Brute Force SSH Penetration with Keys: Metasploitable/SSH/Keys SSH Penetration with Metasploit: Metasploitable/SSH/Exploits Brute-Forcing Exploiting NFS: Metasploitable/NFS Exploiting DNS Bind Server: Metasploitable/DNS Bind
Metasploitable Services: distcc: Metasploitable/distcc
Metasploitable Apache: Exploiting Apache (with Metasploit): Metasploitable/Apache Exploiting Apache (with Python): Metasploitable/Apache/Python Tor's Hammer DoS Attack: Metasploitable/TorsHammer * Apache DAV: Metasploitable/Apache/DAV * Apache Tomcat and Coyote: Metasploitable/Apache/Tomcat and Coyote
Metasploitable Memory: General approach to memory-based attacks: Metasploitable/Memory Investigating memory data: Metasploitable/Volatile Data Investigation Dumping Memory from Metasploit: Metasploitable/Dumping Memory
Metasploitable Fuzzing: (Have not done much work on fuzzing Metasploitable...)
Category:Security · Category:Metasploit · Category:Metasploitable · Category:Kali
|
|
Metasploitablue: The Blue Team Metasploitable is a virtual machine with baked-in vulnerabilities, designed to teach Metasploit. This set of articles discusses the BLUE TEAM's methods for defending Metasploitable: defending against and responding to intrusions.
Hence the name, Metasploita-blue. Overview: Metasploitable/Defenses Metasploitable/Defenses/Stopping · Metasploitable/Defenses/Detecting
Metasploitable On-Machine Defenses: Linux Volatile Data System Investigation: Metasploitable/Volatile Data Investigation Linux Artifact Investigation: Metasploitable/Artifact Investigation Linux Iptables Essentials: Metasploitable/Iptables Firewall Assurance and Testing: Metasploitable/Firewall Password Assessment: Metasploitable/Password Assessment Standard Unix Ports: Unix/Ports
Netcat and Cryptcat (Blue Team): Metasploitable/Netcat and Metasploitable/Cryptcat Nmap (Blue Team): Metasploitable/Nmap Network Traffic Analysis: Metasploitable/Network Traffic Analysis Suspicious Traffic Patterns: Metasploitable/Suspicious Traffic Patterns Snort IDS: Metasploitable/Snort
|