Privilege Escalation from IIS AppPool to NT AUTHORITY\SYSTEM...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://mannulinux.org/2026/08/Privilege-escalation-from-IIS-AppPool-to-NT-AuthoritySYSTEM-via-AD-CS-RPC-endpoint.html
• Blog Title: Privilege Escalation from IIS AppPool to NT AUTHORITY\SYSTEM via the AD CS RPC Endpoint
• Suggested Section: Windows Hardening > Active Directory Methodology > AD Certificates > AD CS Domain Escalation, with cross-references to Kerberos Authentication/S4U abuse and Windows Local Privilege Escalation for IIS application-pool outbound machine-account authentication

🎯 Content Summary

Overview: The post demonstrates a Windows privilege-escalation chain from remote code execution as IIS AppPool\DefaultAppPool on a domain-joined IIS server to privileged access as the server's computer account and then as a domain Administrator over CIFS. The chain does not use a Potato exploit and is not assigned a CVE. It combines IIS outbound authentication behavior, AD CS RPC certificate enrollment, certificate-based Kerberos authentication, S4U2Self, service...

🔧 Technical Details

IIS virtual-account network identity: A process running as an IIS application-pool virtual identity can remain low-privileged locally while authenticating to domain network services as the host's computer account. With code execution inside IIS, force the worker process to access a domain service whose permissions trust computer accounts. This transforms application-level code execution into a machine-account-authenticated network operation without obtaining the computer password.

Attacker-controlled-key AD CS enrollment: Generate the certificate key pair and CSR outside the compromised host, retain the private key, and submit only the CSR through a process that authenticates as a more privileged domain principal. If an enterprise CA template permits that principal to enroll, the issued certificate represents the authenticated principal while the attacker owns the matching private key. Templates that build the subject from Active Director...

🤖 Agent Actions

Updated:

src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md

Added a cited section covering:

• IIS AppPool outbound machine-account authentication
• Attacker-controlled CSR/private-key enrollment via AD CS RPC
• Correct PFX creation caveat and OpenSSL command
• PKINIT machine-account TGT retrieval
• S4U2Self with CIFS service substitution
• Same-host scope and SYSTEM-process clarification
• Event IDs 4886, 4887, 4768, and 4769 for detection
• Technical hardening guidance

Validation passed with git diff --check and custom citation/reference checks. mdbook was not installed, so the full book build was unavailable.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://mannulinux.org/2026/08/Privilege-escalation-from-IIS-AppPool-to-NT-AuthoritySYSTEM-via-AD-CS-RPC-endpoint.html

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Active Directory Methodology > AD Certificates > AD CS Domain Escalation, with cross-references to Kerberos Authentication/S4U abuse and Windows Local Privilege Escalation for IIS application-pool outbound machine-account authentication".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0