darkoperator/Posh-SecMod — pull request #6 by nullbind (2014-03-02 17:35:54+00:00)
Title: Added IIS applicationHost.config PW Dumper

**Get-ApplicationHost Overview**
I added the Get-ApplicationHost function to PostExploitation.psm1. The script will decrypt and display application pool and virtual directory passwords from the IIS applicationHost.config file on the system using appcmd.exe. The output supports the pipeline which can be used to convert all of the results into a pretty table by piping to format-table.

PS C:\>Get-ApplicationHost

user : PoolUser1
pass : PoolParty1!
type : Application Pool
vdir : NA
apppool : ApplicationPool1

user : PoolUser2
pass : PoolParty2!
type : Application Pool
vdir : NA
apppool : ApplicationPool2

user : VdirUser1
pass : VdirPassword1!
type : Virtual Directory
vdir : site1/vdir1/
apppool : NA

user : VdirUser2
pass : VdirPassword2!
type : Virtual Directory
vdir : site2/
apppool : NA