Exploitation

We used the creds to log in to webdav using cadaver and uploaded a .aspx.