Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Decrypting IIS Passwords to Break Out of the DMZ: Part 2

netspi.com | blog | #windows | #powershell | #lateral-movement | #iis | #dmz | #credential-decryption

Summary

Application pool and virtual directory credentials in IIS's applicationHost.config can be decrypted with appcmd.exe or Get-ApplicationHost.ps1, letting attackers pivot from a DMZ web server inward.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Decrypting IIS Passwords to Break Out of the DMZ: Part 1
The post shows how to use native IIS tools to decrypt database connection strings in web.config files, then pivot from a DMZ server into the internal network with recovered credentials.
blog · netspi.com
Decrypting MSSQL Credential Passwords
SQL Server stores credential passwords reversibly encrypted in master.sys.sysobjvalues, so sysadmin attackers can decrypt them. NetSPI updates its PowerShell script for post-exploitation recovery.
blog · netspi.com
Adding PowerShell to Web Shells to get Database Access
A rewritten .aspx web shell embeds PowerShell for direct MSSQL connectivity, showing how much data a simple upload vulnerability exposes when multiple apps share a server, without full compromise.
blog · projectzero.google
aPAColypse now: Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript
A Project Zero write-up showing how a local network attacker can abuse Windows 10 WPAD/PAC proxy files, executed as JavaScript by jscript.dll, to achieve remote code execution.
blog · netspi.com
DEF CON 33: NetSPI’s “Access Everywhere” Experience
NetSPI security experts share key insights from DEF CON 33's "Access Everywhere" theme, from networking with hackers to expanding security expertise through sessions and workshops.
blog · netspi.com
Pivoting Clouds in AWS Organizations – Part 1: Leveraging Account Creation, Trusted Access, and Delegated Admin
Part one on pivoting across AWS Organizations: account boundaries, the 'easy win' of attacker-created member accounts, and abuse of trusted access, delegated administration and IAM Access Analyzer.
back