diff options
| author | Dave Hull <dave.hull@tanium.com> | 2017-09-08 16:33:11 -0500 |
|---|---|---|
| committer | Dave Hull <dave.hull@tanium.com> | 2017-09-08 16:33:11 -0500 |
| commit | 6eb3c6f281f0812a103283d1da80be14bb04f944 (patch) | |
| tree | cfe2e46596ef251274e954c267c5634d62991da2 /docs/Privesc/Get-ApplicationHost.md | |
| parent | bf652bcd261c2c74445c2aa1b4e283c4bf167109 (diff) | |
| parent | 3d0d32d9ee6af70f0dfd5ecfe809a49a65d6822d (diff) | |
| download | PowerSploit-6eb3c6f281f0812a103283d1da80be14bb04f944.tar.gz PowerSploit-6eb3c6f281f0812a103283d1da80be14bb04f944.zip | |
Merge branch 'dev' of github.com:PowerShellMafia/PowerSploit into dev
Diffstat (limited to 'docs/Privesc/Get-ApplicationHost.md')
| -rwxr-xr-x | docs/Privesc/Get-ApplicationHost.md | 95 |
1 files changed, 95 insertions, 0 deletions
diff --git a/docs/Privesc/Get-ApplicationHost.md b/docs/Privesc/Get-ApplicationHost.md new file mode 100755 index 0000000..44d07d7 --- /dev/null +++ b/docs/Privesc/Get-ApplicationHost.md @@ -0,0 +1,95 @@ +# Get-ApplicationHost
+
+## SYNOPSIS
+Recovers encrypted application pool and virtual directory passwords from the applicationHost.config on the system.
+
+Author: Scott Sutherland
+License: BSD 3-Clause
+Required Dependencies: None
+
+## SYNTAX
+
+```
+Get-ApplicationHost
+```
+
+## DESCRIPTION
+This script will decrypt and recover application pool and virtual directory passwords
+from the applicationHost.config file on the system.
+The output supports the
+pipeline which can be used to convert all of the results into a pretty table by piping
+to format-table.
+
+## EXAMPLES
+
+### -------------------------- EXAMPLE 1 --------------------------
+```
+Return application pool and virtual directory passwords from the applicationHost.config on the system.
+```
+
+Get-ApplicationHost
+
+user : PoolUser1
+pass : PoolParty1!
+type : Application Pool
+vdir : NA
+apppool : ApplicationPool1
+user : PoolUser2
+pass : PoolParty2!
+type : Application Pool
+vdir : NA
+apppool : ApplicationPool2
+user : VdirUser1
+pass : VdirPassword1!
+type : Virtual Directory
+vdir : site1/vdir1/
+apppool : NA
+user : VdirUser2
+pass : VdirPassword2!
+type : Virtual Directory
+vdir : site2/
+apppool : NA
+
+### -------------------------- EXAMPLE 2 --------------------------
+```
+Return a list of cleartext and decrypted connect strings from web.config files.
+```
+
+Get-ApplicationHost | Format-Table -Autosize
+
+user pass type vdir apppool
+---- ---- ---- ---- -------
+PoolUser1 PoolParty1!
+Application Pool NA ApplicationPool1
+PoolUser2 PoolParty2!
+Application Pool NA ApplicationPool2
+VdirUser1 VdirPassword1!
+Virtual Directory site1/vdir1/ NA
+VdirUser2 VdirPassword2!
+Virtual Directory site2/ NA
+
+## PARAMETERS
+
+## INPUTS
+
+## OUTPUTS
+
+### System.Data.DataTable
+
+System.Boolean
+
+## NOTES
+Author: Scott Sutherland - 2014, NetSPI
+Version: Get-ApplicationHost v1.0
+Comments: Should work on IIS 6 and Above
+
+## RELATED LINKS
+
+[https://github.com/darkoperator/Posh-SecMod/blob/master/PostExploitation/PostExploitation.psm1
+http://www.netspi.com
+http://www.iis.net/learn/get-started/getting-started-with-iis/getting-started-with-appcmdexe
+http://msdn.microsoft.com/en-us/library/k6h9cz8h(v=vs.80).aspx](https://github.com/darkoperator/Posh-SecMod/blob/master/PostExploitation/PostExploitation.psm1
+http://www.netspi.com
+http://www.iis.net/learn/get-started/getting-started-with-iis/getting-started-with-appcmdexe
+http://msdn.microsoft.com/en-us/library/k6h9cz8h(v=vs.80).aspx)
+
|