Leftover PHP on a ColdFusion IIS server broke sign-in during mitigation
A host-wide IIS rule blocked every multipart form, not just .php requests, until the author narrowed it.
1
Stories per day · 30 days
3 stories, newest first · one card per story
Stories tagged #iis
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Attacker uploaded ASPX webshells to a shared parks-and-rec platform, hitting three servers and hunting cardholder data.
Privilege escalation from IIS AppPool to NT Authority/SYSTEM
A write-up demonstrates privilege escalation from an IIS AppPool identity to NT AUTHORITY/SYSTEM via the AD CS RPC endpoint.