Look at me, I am the C2 Now: Weaponizing IIS server for Active Directory Post-Exploitation

Have you ever wondered "how an attacker having a tiny foothold on an IIS box can launch post-exploitation inside an enterprise network without ever bringing their own tools to the party"? What started as a single challenge, evading detection while trying to land a Potato binary on a hardened host, became the seed of an entire offensive playbook. Somewhere in those challenging times, a thought surfaced, what if the web server was already our C2?

In this session, we will share how that one question reshaped the way we think about IIS post-exploitation, and inspired us to explore what an IIS web server is truly capable of inside an Active Directory environment. Out of that experimentation, we came up with a "Living Off the Web Server" playbook, covering enumeration, exploitation, and privilege escalation tricks inside an Active Directory environment executed entirely from inside the web server itself. The best part? No need to drop any publicly known offensive tools or any type of binaries.