One Day Sec

How is an IIS module registered and installed on a server, and what privileges are required?

An IIS module can be registered via the APPCMD.EXE command-line tool (e.g., `APPCMD.EXE install module /name:test /image:"c:\test\IIS-Backdoor.dll" /add:true`), through the IIS Manager GUI by navigating to Modules -> Configure Native Modules -> Register, or by manually editing `applicationHost.config` or `web.config`. Administrator privileges are required for installation, as the module must be loaded into the IIS worker process. Once registered, the backdoor becomes persistent and active after an IIS restart.
module registrationAPPCMD.exeIIS Manageradministrator privilegesDLL installation

Browse all Q&A →