How can you connect to WebDAV? Probably, you use WebDAV tools like davtest, cadaver, etc. But, if you look carefully at the response of OPTIONS, you can see DAV Methods like PROPFIND, PROPPATCH. These methods are beneficial. If you can not connect with other tools, you can use these methods.

There is no problem until here. But these methods have many capabilities to file updates or uploads.

Recon Capabilities with PROPFIND for example:

The most important point, you can see all files under that requested directory even you have no privilege to see them. Also, you can see file details like usernames, update times, etc.

Then I realized, I can update many file properties and file with these methods.

So, one step ahead we can put our payloads to the system. By the way, I have a good habit. If I wonder a thing I read the RFC Documents. So you can read this document for more details. Because you would discover new properties as you read.

In the first step, I tried to update some properties of files inside of application server.

It was a good start for me. Then I tried other methods but I found Arno0x’s beautiful tool and blog post about excellent usage as a WebDAV C2 of this feature. Please, read it!

I think new payload inputs can be found with these methods. Because you can manipulate all files that you can reach. Also, you can add new files if they misconfigured.

References:

• https://tools.ietf.org/html/rfc4918
• https://docs.microsoft.com/en-us/previous-versions/office/developer/exchange-server-2003/aa486282(v=exchg.65)
• https://arno0x0x.wordpress.com/2017/09/07/using-webdav-features-as-a-covert-channel/
• https://github.com/Arno0x/WebDavC2

Cheers.