blob: 44d07d707e8f480afec6b57d22458d7b2c9a1db3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
# Get-ApplicationHost
## SYNOPSIS
Recovers encrypted application pool and virtual directory passwords from the applicationHost.config on the system.
Author: Scott Sutherland
License: BSD 3-Clause
Required Dependencies: None
## SYNTAX
```
Get-ApplicationHost
```
## DESCRIPTION
This script will decrypt and recover application pool and virtual directory passwords
from the applicationHost.config file on the system.
The output supports the
pipeline which can be used to convert all of the results into a pretty table by piping
to format-table.
## EXAMPLES
### -------------------------- EXAMPLE 1 --------------------------
```
Return application pool and virtual directory passwords from the applicationHost.config on the system.
```
Get-ApplicationHost
user : PoolUser1
pass : PoolParty1!
type : Application Pool
vdir : NA
apppool : ApplicationPool1
user : PoolUser2
pass : PoolParty2!
type : Application Pool
vdir : NA
apppool : ApplicationPool2
user : VdirUser1
pass : VdirPassword1!
type : Virtual Directory
vdir : site1/vdir1/
apppool : NA
user : VdirUser2
pass : VdirPassword2!
type : Virtual Directory
vdir : site2/
apppool : NA
### -------------------------- EXAMPLE 2 --------------------------
```
Return a list of cleartext and decrypted connect strings from web.config files.
```
Get-ApplicationHost | Format-Table -Autosize
user pass type vdir apppool
---- ---- ---- ---- -------
PoolUser1 PoolParty1!
Application Pool NA ApplicationPool1
PoolUser2 PoolParty2!
Application Pool NA ApplicationPool2
VdirUser1 VdirPassword1!
Virtual Directory site1/vdir1/ NA
VdirUser2 VdirPassword2!
Virtual Directory site2/ NA
## PARAMETERS
## INPUTS
## OUTPUTS
### System.Data.DataTable
System.Boolean
## NOTES
Author: Scott Sutherland - 2014, NetSPI
Version: Get-ApplicationHost v1.0
Comments: Should work on IIS 6 and Above
## RELATED LINKS
[https://github.com/darkoperator/Posh-SecMod/blob/master/PostExploitation/PostExploitation.psm1
http://www.netspi.com
http://www.iis.net/learn/get-started/getting-started-with-iis/getting-started-with-appcmdexe
http://msdn.microsoft.com/en-us/library/k6h9cz8h(v=vs.80).aspx](https://github.com/darkoperator/Posh-SecMod/blob/master/PostExploitation/PostExploitation.psm1
http://www.netspi.com
http://www.iis.net/learn/get-started/getting-started-with-iis/getting-started-with-appcmdexe
http://msdn.microsoft.com/en-us/library/k6h9cz8h(v=vs.80).aspx)
|