SECURITY Signal 124
Privilege escalation from IIS AppPool\DefaultAppPool to NT Authority\SYSTEM via AD CS RPC endpoint
↗
A new attack chain lets an attacker with RCE in an IIS application obtain a machine-account certificate from AD CS and use it to impersonate SYSTEM on the host.
Compromising an IIS AppPool is a common foothold for web-server breaches; this technique turns that foothold into full system control without exploiting a separate vulnerability. Engineers responsible for Windows domain environments must consider that legitimate AD CS behavior can be abused to elevate privileges, expanding the impact of any web-application compromise.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The method relies on IIS AppPool identities being automatically translated to the host's machine account when accessing AD CS RPC services.
An attacker submits a crafted CSR from the compromised IIS host, receives a machine-account certificate, and uses Rubeus to request a TGT for the machine account.
The chain fails if AD CS is absent, the default Machine certificate template is disabled, or network policies block the RPC endpoint.
THE READ
What the cluster adds up to.
The disclosed chain starts with remote code execution in a web application running under IIS AppPool\DefaultAppPool. When the compromised code contacts the AD CS RPC enrollment endpoint, Windows silently maps the AppPool identity to the host's machine account. AD CS then issues a certificate based on its default Machine account template, which the attacker can retrieve and combine with the private key generated on a separate Windows machine.
The attacker must generate a CSR and private key on a controlled Windows host, upload ASPX code to the vulnerable IIS server to forward the CSR, and then use the Rubeus tool to request a machine-account Ticket-Granting Ticket (TGT) from the issued certificate. With the TGT, the attacker can perform an S4U2Self request to obtain a service ticket for an administrative user, effectively impersonating NT Authority\SYSTEM on the target host. All steps require only standard Windows utilities and no zero-day exploit.
The technique is limited to environments where AD CS is deployed and the default Machine certificate template is enabled. If the AD CS RPC endpoint is firewalled, the machine-account template is removed, or the IIS AppPool runs under a custom identity that does not map to the machine account, the chain breaks. Additionally, the attack assumes the attacker can upload and execute ASPX code on the IIS server, which may be prevented by strict application-whitelisting or code-integrity policies.
Mitigation strategies include restricting machine-account certificate issuance, disabling the default Machine template, and enforcing network segmentation that blocks unauthenticated access to AD CS RPC services from web servers. Monitoring for unexpected certificate requests from machine accounts and auditing IIS AppPool identities that access domain resources can also help detect early stages of the attack. Engineers should treat any RCE in IIS as a potential path to full system compromise when AD CS is present.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER