# TOLLBOOTH: What's yours, IIS mine

REF3927 abused publicly disclosed ASP.NET machine keys to forge ViewState deserialization payloads, compromising 571 IIS servers to deploy TOLLBOOTH SEO-cloaking backdoor.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft
- Analysis by: Daniel Stepanic, Jia Yu Chan, Salim Bitam, Seth Goodwin, Andrew Pease, Braxton Williams
- Disclosed: 2025-10-22
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/tollbooth
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-tollbooth
- Tags: area:cloud domain:infra domain:web impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:dotnet technique:default-creds vuln:deserialization vuln:rce

**Target:** ASP.NET web application ViewState (__VIEWSTATE) on IIS servers
**Root cause:** IIS servers were configured with ASP.NET machine keys (ValidationKey/DecryptionKey) that were publicly published in Microsoft docs or StackOverflow, letting attackers sign and encrypt forged ViewState payloads that the server deserializes.
**Steps:**
1. Obtain the victim's publicly disclosed ASP.NET machine keys (ValidationKey/DecryptionKey).
2. Generate a .NET deserialization payload (e.g. open-source generator) that runs `whoami` and writes a file.
3. URL-encode and Base64-encode the payload into the `__VIEWSTATE` field of a POST request.
4. Send the POST; server deserializes the forged ViewState and executes the payload (response HTTP/1.1 500 Internal Server Error on success).
5. Deploy Godzilla-forked webshell (error.aspx) for persistent access, then GotoHTTP RMM and TOLLBOOTH IIS module.
**How found:** Investigation of a misconfigured IIS server led to identifying ViewState deserialization abuse; researchers noted the machine keys were reused from public sources and used Validin scanning to enumerate 571 infected servers globally.
**Exploitation:** Forged ViewState payloads gave code execution on IIS servers; actor then deployed Z-Godzilla_ekp webshells, attempted account creation, ran GotoHTTP RMM, attempted Mimikatz credential dumping, and installed TOLLBOOTH IIS module for SEO cloaking and a hardcoded-password webshell (/mywebdll, password hack123456!) to monetize access.
**Escalation:** Chained webshell persistence, RMM C2, credential dumping, and a kernel rootkit (HIDDENDRIVER) to hide artifacts; TOLLBOOTH link-farmed 571 victims into an SEO cloaking network redirecting visitors to malicious pages.
**Insight:** Publicly leaked ASP.NET machine keys are a mass-exploitable initial access vector: check __VIEWSTATE signing keys against known public key lists and test forged ViewState deserialization on any IIS/ASP.NET target.

## Proof of concept (copied exactly from the original report)

**ViewState deserialization POST request PoC**

```
Below is an example of this type of deserialization attack, demonstrated via a POST request in a virtual environment using an open source .NET deserialization payload generator. The __VIEWSTATE field contains a URL-encoded and Base64-encoded payload that will perform a whoami and write a file to a directory. With a successful exploitation request, the server will respond with an HTTP/1.1 500 Internal Server Error.
```

**Multipart reorder file upload PoC**

```
By manually reordering the multipart/form-data parts, a successful file upload can still be triggered.

File upload PoC
```