[MUSIC PLAYING]
Exploiting WebDAV running on Microsoft IIS.
In this video, we will begin the Windows exploitation section,
where we will be covering the process of exploiting
the vulnerable services and protocols that we highlighted
in the previous video.
And to begin, we'll get started by taking
a look at how we can exploit a WebDAV server running
on Microsoft IIS.
However, before we get started with any practical
demonstration as to how this can be done,
we need to get an understanding of what Microsoft IIS is
as well as what WebDAV is.
All right.
So IIS, as we explored previously,
stands for Internet Information Services.
It is essentially a proprietary extensible web server software
developed by Microsoft for the use or for use
with the Windows NT family.
What does this mean?
It really just means that this is
a web server that's developed by Microsoft for Windows.
And, of course, it functions just like any other web
server would.
So it functions just like Apache or Nginx
in that it can be used to host websites and web applications.
And the key advantage of Microsoft IIS
or really just one of them is the fact
that it provides administrators with a robust graphical user
interface for managing the websites that they're
hosting on Microsoft IIS.
All right.
So IIS can be used to host both static and dynamic web pages,
developed in asp.net and PHP.
So you can set it up to host an ASP application or website
or a PHP web application.
And it can typically be configured to run on port 80,
without a TLS or an SSL certificate, and port 443,
when you do have an SSL certificate set up.
Now the supported executable file
extensions that are supported by Microsoft IIS
are dot ASP, dot ASPX, dot config, and dot PHP.
And, of course, this will become relevant in a few minutes
when we get started with the practical demonstration.
All right.
So that's Microsoft IIS.
What about WebDAV?
Well, WebDAV, as we mentioned previously,
stands for Web-based Distributed Authoring and Versioning.
It is a protocol or rather, a set
of extensions to the HTTP protocol,
which allows users to collaboratively edit and manage
files on remote web servers.
So what WebDAV does is it essentially
enables a web server like IIS to function
as a file server for collaborative authoring.
And again, you'll typically see WebDAV
running either on top of Apache or on top of Microsoft IIS.
And in this case, we will be focusing primarily on WebDAV
running on IIS as we are focused on exploiting native Windows
services and protocols.
So WebDAV will run on top of Microsoft IIS on port 80,
as I mentioned previously, without an SSL certificate.
And in the case of an SSL certificate,
it'll run on port 443.
In order to connect to a WebDAV server,
you will need to provide legitimate credentials.
This is because WebDAV implements authentication
in the form of a username and password.
And you can authenticate with WebDAV or to a WebDAV server
by accessing the Microsoft IIS web server through a browser
and specifying the WebDAV folder as we
will be taking a look at in the practical demonstration.
After which, if authentication has been enabled,
you will need to enter in a username and password
combination.
That will essentially grant you or provide you
access to the files that have been set up to be edited
or to be changed.
And, of course, if you don't have legitimate credentials,
you will be denied access.
Now, in terms of WebDAV exploitation,
because that is what we're focusing on in this video,
the first step of the exploitation process
will involve identifying whether WebDAV has been configured
to run on the IIS web server.
So this ties into enumeration and the ability
to detect whether WebDAV is running on a web server
irregardless of whether or not it is IIS or Apache.
And we can then move on to the next step.
So after we have established or essentially confirmed
whether WebDAV is running, we can then perform a brute force
attack on the WebDAV server or the WebDAV authentication form
in order to identify legitimate credentials that we
can use for authentication.
So again, if this is running on a Windows host, in some cases,
you may find that WebDAV doesn't have any authentication.
In that case, the exploitation or the ability
to use WebDAV to gain initial access onto that target system
will be relatively easily.
It will be relatively easy.
If authentication is enabled, you
will then need to perform a brute force attack.
And, of course, we'll be exploring this.
After which, once you obtain the legitimate credentials,
you can then authenticate with the WebDAV server and upload
a malicious dot ASP payload that can
be used to execute arbitrary commands
or obtain a reverse shell on the target.
And as for the actual authentication and the process
of uploading a malicious ASP file,
we'll be taking a look at various tools that
can essentially automate this process right.
So the tools that we will be using in this video
are going to be davtest, which can
be used to scan, authenticate, and exploit a WebDAV server.
It essentially allows you to authenticate to a WebDAV server
or to check with authentication is enabled.
You can then authenticate with the WebDAV server.
And it'll then run a few checks to essentially give you
an idea of what can be done in regards to exploitation.
Davtest comes pre-installed on most offensive penetration
testing distributions like Kali Linux and Parrot OS.
All right.
So if you're following along with this video,
it's pretty much given that you're
going to be running either one of these pen testing
distributions.
We'll then be using cadaver.
Cadaver is essentially a utility that
allows you to authenticate with a WebDAV server
and allows you to upload, download
files to and from the WebDAV server
and allows you to perform a plethora of other functionality
associated with WebDAV servers.
And, of course, it is also pre-installed
on most penetration testing distributions
like Kali and Parrot OS.
It's very important to note, however,
that all the techniques demonstrated in this course
are performed on Kali Linux.
So again, if you're having any issues,
just switch over to Kali Linux, and you'll
be able to replicate this within your own environment.
And for the purposes of demonstrating
this particular attack, we will be
utilizing the lab environment.
So all you need to do is just spin up your lab environment,
and you'll be provided with a Kali Linux system
that you can then use to follow along.
So I'll get my lab environments started up,
and I'll be seeing you in the practical demonstration.
All right.
So I'm currently within the lab environment.
And this particular lab environment
will provide you with the target IP address.
And, of course, in your case, it's going to be different.
So just copy that as we'll be needing it in a few seconds.
All right.
So the first step that we need to perform
is essentially a Nmap scan on the target system
in order to identify the open ports
and the respective services that are running on those ports.
All right.
So I'll open up my terminal here.
And I'll just maximize this, so you can see what's going on.
And I'll just run the Nmap scan.
In this case, we'll be performing a service version
detection scan in order to identify these service
versions.
We can also specify a port range if we
wanted to scan a specific port range or a particular port.
But in this case, we'll just scan the default 1,000 ports,
and then we can provide the IP address.
But in this case, I'll also perform an Nmap script scan
using the default Nmap scripts.
And I'll paste in the target IP.
And I'll hit Enter.
All right.
So I'll give this a couple of seconds to run.
All right.
So the Nmap scan is done.
And as you can see, we have quite a few ports
and services and, of course, a lot of output.
But we can see they're on port 80.
We have a web server running.
And it is running Microsoft IIS version 10.0.
And, of course, we get some of these script output here,
and we'll take a look at that in a few seconds.
And if we take a look at some of the other ports,
you can see that these are the typical services that you would
find running on a Windows system or a Windows host,
with the exception of the MySQL database, right?
And of course, we also have RDP running on this system.
And again, we'll get to that when we get there.
But for now, we are primarily focused on the actual web
server here.
So you can see that it also runs an HTTP WebDAV script.
And this script essentially tells us or provides us
with the following output.
But it doesn't actually give us any useful output in regards
to where the WebDAV or what directory
a WebDAV has been configured on.
And, of course, by default, it will be configured
on the WebDAV directory.
But we can get more information regarding WebDAV with Nmap.
And we can just perform an Nmap scan and again,
service version detection.
In this case, we will limit the scan to port 80
as that is the service that we're interested in.
And then we can use a script called HTTP enum.
And that will essentially tell us
whether we have the WebDAV directory
and whether or not WebDAV is actually
configured on this web server.
And I'll paste in the target IP there.
So I'll hit Enter.
And, of course, I'll give this a couple of seconds to complete.
All right.
So the Nmap scan is complete.
And as you can see, for the WebDAV or the HTTP enum script,
it provides us with very useful output.
So it tells us that the WebDAV directory does exist.
And it says, this is a potentially interesting folder.
And it gives us an error code here, 401 error code,
telling us that we are unauthorized,
which means authentication has been
enabled on this particular WebDAV server.
So we can actually confirm this by opening up our browser,
which in this case is Firefox.
And I'm just going to maximize that,
and I'll paste in the target IP like so.
You can see that a vulnerable web application has
been configured to run, but we are primarily
interested in the WebDAV directory-- so WebDAV.
And it'll tell us authentication required.
And we can then provide a username and password.
And in this case or in this particular lab environment,
the credentials have already been provided for you.
So you don't need to go through the brute force process.
However, I will also be taking you
through how you can brute force this authentication
or authorization form, not just for the WebDAV directory
but for any directory that has authentication configured.
So in order to perform a brute force
on this particular authentication form,
we can utilize the hydra tool, which
is a tool that is used to crack various protocols from FTP,
SSH, and, of course, web authentication forms.
So in order to perform the brute force, what we can do
is use the hydra option.
And because we don't know the username and the password,
we will perform a brute force for both the username.
So to specify the user list or the file that
contains the users that you want to perform
the brute force with, we can say hyphen capital L,
and then specify the username list or the word
list that contains the username by saying user.
In this case, we'll be utilizing a very simple user
list that is stored under user share word list.
And we're looking for the Metasploit word list,
and we are going to use one called common underscore
users dot text.
We then need to provide the password list that, again,
contains the passwords that we're performing
the brute force with.
And in this case, we'll also use the same word list.
So we'll say user share word list Metasploit.
And then we can say common passwords.
Instead of users, we say common passwords dot TXT.
We can then provide the IP or the domain of the target.
In this case, we only have the IP address.
So we'll paste that in there.
We are then going to be utilizing the HTTP GET method
or protocol, if you will.
And we will then specify the directory that contains
the authentication form.
In this case, it's the WebDAV directory.
And we can then hit Enter.
Now, of course, in your case or in a real penetration test,
you want to be very careful with brute force attacks
as they could potentially cause a denial of service
on one of these web servers or really
any service for that matter.
And, of course, you need to be cognizant of the fact
that these word lists--
and, of course, I'm using a very basic one here-- might not
have the credentials or any legitimate credentials that
can be used to authenticate to WebDAV.
So you'll need to perform some more reconnaissance in order
to identify a list of users that you're certain will actually
have access to WebDAV.
And, of course, for the passwords,
there's multiple password lists that you
can use that are quite comprehensive
and can actually have a very high chance of giving you
the actual credentials or providing you
with the actual credentials.
So once that is done, we just hit Enter.
And it's going to begin performing the brute force.
And you can see that it tells us, target completed,
zero valid passwords found.
And that's how to perform a brute force on the WebDAV
authentication form.
Now, as I said, in this case, we don't
need to perform the brute force because it's
going to take a lot of time.
And for the purpose of saving time and being efficient,
the credentials have already been provided to you
within this lab environment.
And, of course, we know that the username is Bob
and the password is password underscore 123321--
so very simple username and password combination.
So we can actually test and confirm
whether this is the case by heading over to our browser
and providing the credentials there.
So I can say Bob and password, underscore 123321,
and I hit Enter.
And as you can see, those credentials are legitimate.
And it will authenticate us, and we can now
access the contents of the WebDAV directory here.
And in this case, we only have two files.
We have an attack defense dot TXT file
and a web dot config file.
So what do we do with this folder or with this access?
Well, remember, we need to have an understanding
of what WebDAV is.
WebDAV is a very useful protocol that
allows us to essentially upload, download
files from this directory as well as modify and delete files
within this directory.
But how do we do this?
Well, we can do this through the use of various tools.
And as I said, we're going to get started with davtest.
So davtest, again, as I said, comes pre-packaged with Kali.
And in this case, it is pre-installed.
And in order to use it, you simply need to type in davtest.
And for the sake of going over how this tool works,
we can open up the documentation page.
And we have the ability to actually perform the davtest
or to actually check whether WebDAV has been configured
on a web server.
And we can also authenticate with the WebDAV server.
And I'll take you through that process right now.
So to begin with, what we can do is
say davtest, and then specify the URL of the actual WebDAV
server.
In this case, it's HTTP.
We then put in the target IP address and the actual WebDAV
directory.
And we hit Enter.
And this is going to tell us testing the DAV connection.
It's going to tell us that it's open,
but it fails because authentication is enabled.
So we can specify the credentials by saying davtest,
and then we say auth, provide the credentials.
So we specify the username first and then
the password, which in this case is password underscore 123321.
And then we specify the URL right over here.
And we say HTTP target IP and WebDAV.
So we can now hit Enter.
And what this is going to do is it's
going to perform a series of checks that will actually
tell you what types of files we can upload
or what types of files can be executed on the WebDAV server.
And this is going to be very, very important.
So let me just zoom in or zoom out here.
There we are.
So I'll just zoom out a little bit,
so we can see what's going on.
So let's take a look at the output a little bit more.
So you can see it actually test the DAV connection here.
It is successful in this case because we provided
the actual credentials.
And it generates a random string for this session that
will be essentially appended to any of the directories
or files that are created.
So you can see, first of all, tests
and sees whether we can create a directory within the WebDAV
folder.
And in this case, it creates a directory
called davtest directory and then appends
the actual random string.
And you can see that is successful.
It'll then try and upload various types
of files with different extensions
like TXT files, JSP, ASPX, ASP, Perl, JHTML, et
cetera, et cetera.
And it provides you with the URL as well as the actual name.
So they upload it into the davtest directory.
And the names of the files are just dev test
and then the random string is appended here,
dot TXT, dot TSP, et cetera.
And in this case, all of them were successfully uploaded.
It will then check-- and this is the most important section.
It'll then check for execution.
So we'll check for test file execution.
So it'll actually see what files or what file formats can be
executed on this WebDAV server.
And this is very important because if you
can see in the case of ASP if it's successful,
that means we can generate an ASP payload,
or we can utilize an ASP web shell
to gain some form of command execution on the target
or to obtain some form of command execution.
So in this case, you can see that dot TXT
files can be executed.
Well, not really but in this case,
the most important one is going to be the ASP file.
So it tells us that is successful.
So that means we can execute ASP files here.
And you can see that will then give you a summary.
So now that we know what we can execute on the WebDAV server,
we can utilize the cadaver utility to essentially upload
our web shell, our ASP web shell.
And I'm just going to clear out the terminal.
If I open the cadaver utility and I open up the documentation
or I just hit Enter, it's going to give you
with the actual cadaver prompt.
And I'll get to that in a second.
But I can say, cadaver help, and it will then
provide you with the documentation, which
you can go through.
However, it really is very, very, very simple
to understand and to use.
All you need to do is say, cadaver.
And remember, we're utilizing cadaver
to actually access the contents of the actual WebDAV directory.
Cadaver will allow us to download files from the WebDAV
directory, upload files to the WebDAV directory, delete files,
edit files, so on and so forth.
So we can say, cadaver HTTP.
We provide the actual target IP address and the directory.
So which in this case is WebDAV.
We hit Enter.
It's going to ask us for the credentials.
So we say Bob is the username, and the password
is password underscore 123321.
We then hit Enter, and it'll then provide you
with a pseudo shell here that allows
you to navigate or interact with the WebDAV server.
So I can say LS.
And in this case, it lists out the content
of the WebDAV directory.
And you can see, we have the davtest directory
that was created by davtest as well as
the files that we were able to enumerate previously
when we accessed the WebDAV directory through our browser.
So what we can do is we can upload a web shell in order
to essentially obtain some form of command
execution on the target system.
And in order to do that, we are going
to open up a new tab here.
And Kali Linux comes pre-packaged with a series
of web shells, and they can be accessed under the user share
web shells directory.
And if I list out the contents of the web shells directory,
you can see the assorted based on the extension
or the type of web shell.
In this case, we know that only ASP files can be executed.
So we're looking for ASP web shells,
and we can utilize the web shell dot ASP web shell here.
So all we need to do to upload it
to the actual davtest directory is head back over to cadaver.
And we can then stay, put, and we specify the actual path
to the web shell.
So user share web shells ASP web shell dot ASP.
We hit Enter.
That's going to upload it.
And you can see, it tells us that is uploaded successfully.
So if we head back into our browser
and we refresh the actual listing
of the files within the WebDAV directory,
you can see we have the davtest directory here that was created
and the test files that were uploaded
with their respective extensions.
If we go back here, we can execute or launch the web shell
by clicking on it.
And as you can see, this will provide you
with an input box that allows you
to perform command execution or essentially
allow you to execute commands on the target system.
After which, the output of those commands
will then be output on this page.
So because the target is a Windows system,
we can run commands like, who am I?
And the output will be provided here.
In this case, you can see it provides us
with the output for that.
So I can say IP config to display our actual interface.
So that is IP config.
There we are.
And you can see, it tells us this is the ethernet adapter.
And it provides us with the IP address, the gateway,
et cetera, et cetera.
And, of course, we can also perform
other types of commands.
And in the case of this lab, your objective
is to find the actual flag.
So in order to find the flag, we can list out
the actual directory or the files within the C drive,
and we can list the actual root of the C drive.
So I'll hit Directory C. And you can
see that the flag is stored within the root of the C drive.
So to access the flag, we can simply type in, type,
and then we say, C flag dot TXT, and hit Run.
And we get the actual flag that you
are supposed to obtain for this particular lab.
All right.
So that is how to exploit WebDAV running on Microsoft IIS.
And, of course, we've simply taken a look
at one of the exploitation vectors.
In the next video, we'll explore the process
of uploading a Metasploit backdoor that can provide us
with a reverse shell.
So this is going to conclude the practical demonstration
side of this video.
All right.
So that concludes the first video on WebDAV exploitation.
In the next video, as I mentioned,
we will be taking a look at how to utilize the Metasploit
framework to gain a reverse shell
or an interpretive session on the target system
by uploading a malicious ASP payload.
And again, we'll be taking a look
at how that can be facilitated.
So I'll be seeing you in the next video.