Privilege escalation in Microsoft IIS 5.0 via relative-path system file loading

Microsoft Internet Information Services (IIS) 5.0 uses relative paths when locating certain system files that are executed in-process. This unsafe search-path behavior allows a local attacker to place a Trojan horse file, including a malicious replacement for a DLL expected by IIS, in a location that will be resolved before the legitimate system file. When IIS loads the attacker-controlled file in-process, the malicious code executes in the security context of the IIS service, resulting in privilege elevation. The provided context specifically references abuse through side-loading a malicious httpodbc.dll on older IIS servers.