davtest 1.1 - Exploits WebDAV folders
Perl PHP ASP Java ColdFusion
Latest commit f8e53a6 May 3, 2015 cldrn Updates readme
Permalink
Failed to load latest commit information.
backdoors Adds davtest 1.1 May 3, 2015
tests Adds davtest 1.1 May 3, 2015
LICENSE Initial commit May 3, 2015
README.txt Updates readme May 3, 2015
davtest.pl Adds davtest 1.1 May 3, 2015

README.txt

#############################################################
Copyright 2015 Websec, SC.

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.

Author (1.0): Chris Sullo / csullo [at] sunera . com
Author (1.1): Paulino Calderon / calderon [at] websec . mx

#############################################################
About

This program attempts to exploit WebDAV enabled servers by:
- attempting to create a new directory (MKCOL)
- attempting to put test files of various programming langauges (PUT)
- optionally attempt to put files with .txt extension, then move to executable (MOVE)
- check if files executed or were uploaded properly
- optionally upload a backdoor/shell file for languages which execute

Additionally, this can be used to put an arbitrary file to remote systems.

#############################################################
Requirements

The following PERL modules are required from cpan.org:
	HTTP::DAV
	Getopt::Long

#############################################################
Options

davtest.pl -url url [options]
 -auth+         Authorization like user:password. Supports Basic and Digest only, no NTLM (yet).
 -realm+        Authorization realm
 -cleanup       Delete everything uploaded except backdoor/shell files
 -directory+    Postfix of directory to create. This is always prefixed by 'DavTestDir_' and if not specified
                is set to a random string.
 -debug+        HTTP::DAV debug level 1-3. Levels 2 and 3 log request/responses to /tmp/perldav_debug.txt.
 -move          PUT files as .txt and then try to MOVE them to the executable file extension
 -nocreate      Don't create a directory, work at the -url level.
 -quiet         Only print out summary and serious (usually fatal) errors.
 -random name+  Use this string instead of a random string for filenames.
 -sendbd+       Send backdoor files (from backdoors/ directory). See each script's source for how to use it, if
                it's not immediately obvious.
                        auto - for any succeeded test
                        ext - extension matching file name(s) in backdoors/ dir
 -uploadfile+   Upload this file to to the server. This option requires -uploadloc to specify the remote location.
 -uploadloc+    Upload -uploadfile to this location/name. This option requires -uploadfile.
 -url+          Url of the DAV location.

#############################################################
Test Files

Tests are used to determine if the server can execute a certain type of code. Each test may have a 
corresponding backdoor file, but backdoor files *must* have a corresponding test to determine if 
that file type can execute on the server. It is recommended a simple/basic operation for each language
is used--by default, the supplied tests use mathematical calculations, if possible.

Test files are located in the 'test/' directory. Files must be named according to
the type of program file they will become on the server. For example, a file named 'php.txt'
will be put to the server with a .php extension. 

Each file must have two lines, 'content' and 'execmatch'--the body put to the server and regex to 
match to see if it executed. For example, the php.txt contents are:
	content=<?php print 7.8 * 6.4;?>
	execmatch=49.92

Additionally, the token $$FILENAME$$ will be replaced (with the PUT file's name) in the content before
it sent to the server. Embedded newlines (\n) will be converted to actual newlines (to accommodate PERL).

#############################################################
Backdoor files

Backdoor files are located in the 'backdoors/' directory. They must have the match extension for the type 
they will be uploaded for. For example, a php backdoor must have a '.php' extension.

A backdoor file can contain any code you desire, and multiple backdoor files may be used for a file type. 
If multiple files exist for a type, each will be uploaded when appropriate.

A backdoor type (e.g., php) *must* have a corresponding type in the 'tests/' directory, otherwise it will 
never be tested/uploaded.

#############################################################
Examples

Example: Test file uploads at this location url:
		davtest.pl -url http://localhost/davdir

Example: Test file uploads at this location url and send backdoors for any that succeed:
		davtest.pl -url http://localhost/davdir -sendbd auto

Example: Upload a file using authentication, send the perl_cmd.pl backdoor and call it perl.pl on the server:
		davtest.pl -url http://localhost/davdir -auth user:pass -uploadfile backdoors/perl_cmd.pl -uploadloc perl.pl

#############################################################
TODO:
	- NTLM authentication
	- Backdoors for more languages 
	- Validate jhtml test syntax

#############################################################
CHANGELOG

1.1 - Fixes auth and adds realm support