Attacking WebDAV Protocol

WebDAV (Web-based Distributed Authority Version) is a legacy protocol that can be defined as an extension of the HTTP protocol for collaborative file editing, as well as remote file management from an application. As mentioned, WebDAV is an obsolete protocol, but it is still relevant, given that it was exploited by Bumblebee malware back in 2023.

There are usually routes in the application like /webdav, which require login via dialog box (although it is possible to log in via URL), and the default credentials are usually webdav:webdav, but since this is not the law, we can try to brute-force it with Hydra.

hydra -L <user wordlist> -P <password wordlist> <host> http-get /webdav

Once logged into the WebDAV protocol we would be redirected to a directory listing, but more interesting than listing the files, we can test uploading a reverse shell via the HTTP PUT method:

curl -T <reverse shell> <URL>

Note: a particularity of PHP is that it does not overwrite existing files.

From there, just run the commands and be happy!

Comments

[疏影]

Great breakdown — the layered view (protocol vs server vs client) matches what we see in the field.

One thing that bit us hard enough to write about: the gap between a mounted WebDAV share and a real disk is not permissions, it's whether the client exposes a filesystem device. Backups, sync tools and installers all branch on that, and many silently skip a mapped network drive instead of failing loudly.

Two quick checks on Windows: create a file and rename it while an Explorer window is open; and check whether the OS reports the share as a fixed disk rather than a network drive. If the second fails, a tool that "supports WebDAV" will likely skip your workflow.

Full disclosure: I work on the tool I name below. ScsDriver is a WinFsp-based WebDAV client for Windows that mounts the share as an actual filesystem device, so those checks pass and tools that skip network drives don't. It is $5.50 as a one-time lifetime license at the moment, not a subscription.