> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/dav.md).

# Dav

![](/files/-McL3Nc85Vjx7PKe8H5e)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.1.27
```

![](/files/-McL3kaNaiUd0TFzCD-e)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 80
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 80 -oN nmap 10.10.1.27
```

![](/files/-McL4DfVADBd-ZOakAmx)

## Enumeration

Lets visit the site

![](/files/-McL4_sRBBjBlDK8Zbzg)

Its a default apache2 page, lets run gobuster to find hidden directories.

```
gobuster dir -w /usr/share/wordlists/dirb/common.txt -u http://10.10.1.27/ 
```

![](/files/-McL6AE4we71Ln_lj5Kz)

We have a directory called `/webdav`, lets go check it out.

![](/files/-McL6JkylQ_BziOkSysA)

We have to login, we do not have a username or a password, lets go look for default credentials. Looking on google , I found this [article](http://xforeveryman.blogspot.com/2012/01/helper-webdav-xampp-173-default.html), and found a default username and password

![](/files/-McL6hROVrJVoxMrrtDv)

Now lets try to login

![](/files/-McL6skmUVOSzLhbQfyq)

We are logged in, lets look at the `password.dav` file.

![](/files/-McL6zKeEl1pPNylwKWU)

We have a username and a password.

## Exploitation

After this I looked for vulnerabilities for webdav and found that we can upload a file and then get a reverse shell if we upload a reverse shell.

We can upload a file using this command, you can find a reverse shell [here](https://github.com/pentestmonkey/php-reverse-shell).

```
curl --user "wampp:xampp" http://10.10.1.27/webdav/ --upload-file /root/shell.php
```

![](/files/-McL91Lf32Hx-BgXYgOl)

After uploading it, refresh the page and you should see the file

![](/files/-McL9OkAwLOXXLPsl7KN)

Now lets start a reverse shell listener.

![](/files/-McL9UpNcgQ9cqcxAS8i)

Now click the file on the webpage and you should get a reverse shell.

![](/files/-McL9dQ0JOW2sp6ISpAM)

Now lets stabilize the shell.

![](/files/-McL9vM6fk7c9sYKQJ3z)

Now you can read the user flag.

![](/files/-McLA9Y3zBj4_HQKTVaa)

## Privilege Escalation

Lets run `sudo -l` to see what we can run as other users.

![](/files/-McLANo7y8NId4cf_UCb)

Looks like we can run /bin/cat, lets read the root.txt file with this

![](/files/-McLAY9XWNje8w0_oQFW)