# Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers

Attacker registered member accounts on a recreation management platform, uploaded .aspx webshells to MemberFiles, stole payment card data and trojanized jQuery to skim credentials.

- Payout: Real-world hack
- Severity: critical
- Program: Recreation management platform
- Credited: Huntress
- Disclosed: 2026-09-30
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/parks-recreation-platform-webshell-attack
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-parks-recreation-platform-webshell-attack
- Tags: domain:web impact:ato impact:data-leak kind:incident platform:threat-intel sev:critical tech:dotnet tech:payment technique:recon technique:source-review vuln:file-upload vuln:rce

**Target:** ASP.NET/IIS multi-tenant web servers, member file upload endpoint /documents/MemberFiles/
**Root cause:** Member file upload accepted .aspx files and stored them in a web-accessible directory served by IIS, allowing direct execution of attacker-supplied server-side code.
**Steps:**
1. Register a member account on the platform
2. Upload `shell.aspx` to `/documents/MemberFiles/` via the member file upload feature
3. Request `/documents/MemberFiles/<accountID>_<memberID>_<guid>.aspx?key=wf9x` to execute commands
4. Run `cmd.exe /c whoami`, `appcmd.exe list sites`, `findstr connectionString web.config` to enumerate
5. Use extracted SQL creds with `sqlcmd` to query cardholder data
6. Copy webshells to `E:\Content\info\includes\css_bundle.aspx` etc. and timestomp to match web.config
7. Append obfuscated dropper to `jquery.mousewheel-3.0.6.pack.js` loaded by `/auth/default.aspx`
**How found:** Attacker spent ~6 hours on failed unauthenticated probes (brute force, IIS tilde, WebDAV, parser bypasses) before trying the simplest path: self-registering an account and abusing the member file upload, discovering .aspx files were stored and executed from /documents/MemberFiles/.
**Exploitation:** After account registration, uploaded .aspx webshells executed OS commands as the IIS worker. Attacker enumerated IIS config, harvested web.config connection strings, connected to SQL with sqlcmd, and dumped Fortis webhook logs containing card numbers, CVVs, expirations. Later trojanized a jQuery asset on the auth page to turn every visitor's browser into an encrypted WebRTC/WebSocket C2 client harvesting credentials.
**Escalation:** Chained upload RCE to credential theft from web.config, then DB access for cardholder data, then client-side supply-chain trojanization of a shared jQuery asset to compromise all platform users.
**Insight:** When unauthenticated attack surface is hardened, register a legitimate low-privilege account and test every file-upload sink for server-side extension execution and web-accessible storage paths — member-facing uploads often land in directories IIS will happily execute.