tl;dr

• RCE by uploading web.config
• Windows IIS 7.5
• MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege