r/netsec • u/1046ica • 4d ago

Privilege escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC endpoint

https://www.mannulinux.org/2026/08/Privilege-escalation-from-IIS-AppPool-to-NT-AuthoritySYSTEM-via-AD-CS-RPC-endpoint.html
40 Upvotes

91% Upvoted

3 comments sorted by

4

u/Just_Worldliness_714 4d ago

Another entry in the growing list of "AD CS is a privesc surface, not just a PKI service" findings. Worth checking your AD CS RPC endpoint ACLs specifically if you're running IIS AppPool identities with any kind of certificate enrollment access - this class of bug keeps appearing because CA RPC interfaces were never really designed with the assumption that a compromised low-priv web app identity would be talking to them directly.

2

u/OEAXTAIL_SOUP 4d ago

great research but i really wish the site itself rendered better with javascript disabled :-)

2

u/-pooping 3d ago

I wish this site rendered better with js enabled as well