File Upload via WebDAV (PUT + MOVE)

WebDAV (Web Distributed Authoring and Versioning) is an HTTP extension that adds methods to manage files on a web server: PUT (upload), DELETE (delete), COPY, MOVE (rename / move), MKCOL (create directories), PROPFIND/PROPPATCH, LOCK/UNLOCK. If misconfigured, those methods turn a web server into a writable disk for the attacker.

The PUT + MOVE bypass. A common security control is to filter by extension on upload: the server blocks .asp/.aspx (what IIS would execute) but allows uploading .txt, .html, etc. The flaw is that the filter only applies to PUT, not to rename. The technique:

1. Upload the webshell with an allowed extension (.txt):

` curl -s -X PUT http://<ip>/cmdasp.txt -d @cmdasp.txt `

1. Rename it to the executable extension with MOVE:

` curl -s -X MOVE -H "Destination: http://<ip>/cmdasp.aspx" http://<ip>/cmdasp.txt `

Once turned into .aspx, IIS interprets it and you achieve command execution. The validation covered the upload operation but not the rename: that's the hole.

Prior enumeration. The davtest tool probes which file types the server accepts and makes the scenario clear:

davtest -url http://<ip>

If it reports uploading txt/html but rejecting asp/aspx, the MOVE bypass is the way.

Where it shows up. It was the entry vector of Granny (IIS 6.0 with PUT/MOVE enabled), twin of Grandpa, which instead falls to the version vulnerability. The webshell gives a shell as NETWORK SERVICE and from there churrasco elevates to SYSTEM.

How to detect it. The IIS-log signature is the uncommon WebDAV verbs: a PUT of a .txt/.html followed by a MOVE with a Destination header renaming it to .aspx/.asp, a sequence no normal client performs. A spike of PUT/MOVE/PROPFIND from one IP (typical of davtest) is the recon. Confirmation is a new executable file in the upload directory (FIM) and, on requesting it, w3wp.exe spawning cmd/powershell (4688/Sysmon 1 with ppid=w3wp). A WAF blocking MOVE/COPY with a Destination to executable extensions cuts it.

Defence. Don't enable WebDAV write methods unless expressly needed; if used, validate the file type on ALL operations (including MOVE/COPY), not just upload; apply extension allowlists by content (not by name) and deny script execution in upload directories.