From a Single Alert to 1,000 Files Inside an Exposed WebDAV ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis
• Blog Title: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > WebDav, with cross-references from Phishing Files & Documents and Windows process/DLL search-path hijacking content

🎯 Content Summary

Overview

Rapid7 traced an MDR alert to an exposed WebDAV malware-delivery environment containing 1,048 files. The alert began when a user executed WebDAV-hosted content through rundll32.exe; endpoint telemetry then showed the Windows WebClient service starting and davclnt.dll contacting the remote server. The exposed infrastructure was not simply a payload repository: it functioned as a malware development, delivery, and quality-...

🔧 Technical Details

WebDAV working-directory hijacking: Create an .url shortcut whose URL launches a legitimate signed binary and whose WorkingDirectory points to an attacker-controlled WebDAV share. If the binary subsequently invokes a child by bare filename, place a malicious executable with that exact name on the share. For example, iediagcmd.exe invokes names such as route.exe, ipconfig.exe, netsh.exe, and ping.exe; a remote route.exe may therefore replace the intended local utility. The technique fails when the parent uses a fully qualified child path, requires unavailable arguments, is absent, or has been patched.

Discovery of additional vulnerable LOLBins: Build shortcuts for candidate .NET or Windows binaries, assign the same WebDAV working directory, and upload harmless MessageBox executables under likely child-process or dependency names....

🤖 Agent Actions

Using the repository-guided workflow: first I’ll inspect existing HackTricks pages and read the most relevant ones before deciding the single best place to add concise, non-duplicative content.
I’ve now compared the directly related WebDAV/phishing/NTLM/service-trigger pages. Next I’m checking exact placement and then I’ll patch only the single best file to avoid duplication.
I’ve confirmed the other techniques in the blog are already documented elsewhere in HackTricks. I’m updating only the WebDAV page with the missing client-side WebDAV execution and Explorer-delivery techniques, then I’ll verify the final markdown and references.
Done.

Updated:

• src/network-services-pentesting/pentesting-web/put-method-webdav.md

Added concise new coverage for:

• Client-side WebDAV delivery/execution
• .url + remote WorkingDirectory WebDAV hijack
• search-ms: / .library-ms Explorer lures
• Detection ideas
• References to the Rapid7 post and NVD

Verified:

• Internal markdown links point to existing files
• ## References remains at the end
• Banner include remains intact

Note:

• mdbook build could not be run because mdbook is not installed in this environment.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > WebDav, with cross-references from Phishing Files & Documents and Windows process/DLL search-path hijacking content".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0