dfirhub

IISConfiguration

Windowsv1

Author: NVISO (@NVISOsecurity)

description

IIS

paths

4 paths
AppsIIS applicationHost.config
C:\Windows\System32\inetsrv\config\applicationHost.config

This configuration file stores the settings for all your Web sites and applications.

AppsIIS administration.config
C:\Windows\System32\inetsrv\config\administration.config

This configuration file stores the settings for IIS management.

AppsIIS redirection.config
C:\Windows\System32\inetsrv\config\redirection.config

This configuration file contains the settings that indicate the location where the centralized configuration files are stored.

Appsweb.config
C:\inetpub\wwwrootweb.config

The web.config is a file that is read by IIS and the ASP.NET Core Module to configure an app hosted with IIS.

› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: IISConfiguration
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. IIS applicationHost.config
Collect-Artifact -SourcePath "C:\Windows\System32\inetsrv\config\\applicationHost.config" -FolderName "IIS_applicationHost_config"

# 2. IIS administration.config
Collect-Artifact -SourcePath "C:\Windows\System32\inetsrv\config\\administration.config" -FolderName "IIS_administration_config"

# 3. IIS redirection.config
Collect-Artifact -SourcePath "C:\Windows\System32\inetsrv\config\\redirection.config" -FolderName "IIS_redirection_config"

# 4. web.config
Collect-Artifact -SourcePath "C:\inetpub\wwwroot\web.config" -FolderName "web_config"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

references