It’s been a while since I linked to Cesar Cerrudo’s slide deck about token kidnapping. Now there is also a POC available (with samples how to use it from SQL Server and IIS).

There is also some movement at MS now…(here, here)

Quoting from the recommendations page of the original slide deck:

• Windows XP and 2003
• On IIS 6 don’t run ASP .NET in full trust and if classic ASP is enabled don’t allow users to execute binaries
• On Windows Vista and 2008
• On IIS 7 don’t run ASP .NET in full trust or don’t run web sites under NetworkServer or LocalService accounts
• Don’t run services under NetworkService or LocalService accounts
• Use regular user accounts to run services