TryHackMe — Dav (THM)
Enumeration
From the port scan we can see that it only has port 80 enabled.
Since http is open, let’s do a directory scan.
Exploitation
Before doing anything I searched if metasploit contained any exploit for webdav, which it did. So I tested the exploit for uploading a php file, which didn’t work.
So now I tried brute forcing for a while, but didn’t really give anything after a few minutes. So I searched up for default login credentials.
What worked was wampp:xampp
We can also see the php file metasploit uploaded earlier but was unable to create a session.
Checking all the metasploit settings, looks like it was right from the start.
Looked back and looks like I was using a windows exploit for a linux machine.
Get Corlis’s stories in your inbox
Join Medium for free to get updates from this writer.
Instead of overcomplicating it with metasploit, I just made use of cadaver which is a built-in tool for accessing webdav on kali for uploading a reverse shell php file.
Now to just open the file from the browser.
user.txt
Answer: 449b40fe93f78a938523b7e4dcd66d2a
Escalation
Now to test pretty common escalation techniques.
Looks like we have cat sudo privileges.
root.txt
This was pretty easy since we know the file name, if now I would have tried and brute force the password on /etc/shadow.
Answer: 101101ddc16b0cdf65ba0b8a7af7afa5
