> For the complete documentation index, see [llms.txt](https://snowyowls-organization.gitbook.io/snowyowl644-hacklog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://snowyowls-organization.gitbook.io/snowyowl644-hacklog/vulnlab/trusted/10.10.158.85.md). # 10.10.158.85 ![](https://i.imgur.com/Ivzy4ge.png) * URL : * \#easy * OS : #Windows * Machine Author(s): * Hack Date: 2025-10-16,20:06 ## Enumeration Principle 1. **目に見えるものだけがすべてではない。** あらゆる視点を考慮しろ 2. 見えていることと、見えていないことを区別しろ 3. **常に情報を得る手段は存在する。** 対象をしっかり理解しろ ### Nmap | **ポート** | **サービス** | **バージョン** | **その他** | | --------- | ------------ | --------------------------------------- | ----------------------------------------------------------------------------- | | 53/tcp | **DNS** | Simple DNS Plus | | | 88/tcp | **kerberos** | Microsoft Windows Kerberos | server time: 2025-10-16 11:00:37Z | | 135/tcp | msrpc | Microsoft Windows RPC | | | 139/tcp | netbios-ssn | Microsoft Windows netbios-ssn | | | 389/tcp | **ldap** | Microsoft Windows Active Directory LDAP | Domain: trusted.vl0., Site: Default-First-Site-Name | | 445/tcp | **SMB** | 不明 | | | 464/tcp | kpasswd5? | 不明 | | | 593/tcp | ncacn\_http | Microsoft Windows RPC over HTTP 1.0 | | | 636/tcp | **LDAPS** | 不明 | | | 3268/tcp | ldap | Microsoft Windows Active Directory LDAP | Domain: trusted.vl0., Site: Default-First-Site-Name | | 3269/tcp | tcpwrapped | 不明 | | | 3389/tcp | **RDP** | Microsoft Terminal Services | RDP情報あり（Target\_Name: TRUSTED, DNS: trusteddc.trusted.vl, OS Ver: 10.0.20348） | | 5985/tcp | **WinRM** | Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) | http-title: Not Found | | 9389/tcp | mc-nmf | .NET Message Framing | | | 47001/tcp | http | Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) | http-title: Not Found | | 49664/tcp | msrpc | Microsoft Windows RPC | | | 49665/tcp | msrpc | Microsoft Windows RPC | | | 49666/tcp | msrpc | Microsoft Windows RPC | | | 49667/tcp | msrpc | Microsoft Windows RPC | | | 49669/tcp | msrpc | Microsoft Windows RPC | | | 49672/tcp | ncacn\_http | Microsoft Windows RPC over HTTP 1.0 | | | 49673/tcp | msrpc | Microsoft Windows RPC | | | 49674/tcp | msrpc | Microsoft Windows RPC | | | 49685/tcp | msrpc | Microsoft Windows RPC | | | 49688/tcp | msrpc | Microsoft Windows RPC | | | 53370/tcp | msrpc | Microsoft Windows RPC | | | 61192/tcp | msrpc | Microsoft Windows RPC | | ```bash PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-10-16 11:00:37Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: trusted.vl0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped syn-ack ttl 127 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: trusted.vl0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped syn-ack ttl 127 3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services | rdp-ntlm-info: | Target_Name: TRUSTED | NetBIOS_Domain_Name: TRUSTED | NetBIOS_Computer_Name: TRUSTEDDC | DNS_Domain_Name: trusted.vl | DNS_Computer_Name: trusteddc.trusted.vl | Product_Version: 10.0.20348 |_ System_Time: 2025-10-16T11:01:47+00:00 |_ssl-date: 2025-10-16T11:01:54+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=trusteddc.trusted.vl | Issuer: commonName=trusteddc.trusted.vl | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-10-15T10:26:15 | Not valid after: 2026-04-16T10:26:15 | MD5: a811:4cb3:5767:7a61:ee7f:aa53:6b17:297d | SHA-1: 7006:6d95:a257:872e:d4f1:e31d:749e:e5c4:5373:6571 | -----BEGIN CERTIFICATE----- | MIIC7DCCAdSgAwIBAgIQbXITGTo5WIhLNoX9ti/juTANBgkqhkiG9w0BAQsFADAf | MR0wGwYDVQQDExR0cnVzdGVkZGMudHJ1c3RlZC52bDAeFw0yNTEwMTUxMDI2MTVa | Fw0yNjA0MTYxMDI2MTVaMB8xHTAbBgNVBAMTFHRydXN0ZWRkYy50cnVzdGVkLnZs | MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqFVcb/5E2nPGmtODcWa7 | 0+tHUh5oRNyBI/23JLf9rociShgTQ+6rcV1YBFWqC2WNW235WmWvJJT3YU8Y0Q9e | X7WzKsbo+gLIHaew5KuLwen2LK3kle/FXdM/Ok0GEGdhTN6pmR2tfTuAksdjOmys | TxGsUAukwbhOVZu7wAFnDC7wMr0DF0RvXGinyf8B3B5igPn86ScrSyKA7cqvktVR | 5IusaY+rF6PD5ysBzpFWj4CdS2NNUv3EjstR22OqryFzj6kgeBA0KWec6lh/3/SX | r/VLKFQUbNPcorIujvEIZ8kOOMmXJliOXBA5ncRrItJXAhEgfeP0qz/50L9VpZ4z | fQIDAQABoyQwIjATBgNVHSUEDDAKBggrBgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJ | KoZIhvcNAQELBQADggEBADe+Gvm+AWU7MPhTO9Ukq4Zdr9HaHAq8BmugHYUykwz4 | n0xO9N9NBFTwS+K4q7w+UFEVcK9BKHutgceXg5u9bq7mkMlUXUX74zznotiPpUde | VS2Qom/Uoc9wQ40y/WF5/S+SrcRw0fVBgEGhbLZlGIywh0F1sK+acyhuRLYgzI/9 | zcPXI+wLnv41PJqku+Meuo0teLcbX+6VMxiu1OOCLwnms1ZVwyea/c/3eZM8c3nT | mGvfWKPkkXHT1jkBDIqp/2FXI5NTq2uDTW8cdd9P/qxbjFkuLTywez45PHszGqHO | zWvZUM4spF5wYGU8adJMDJTZM0k5xZ8snRFsiVUJVMU= |_-----END CERTIFICATE----- 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing 47001/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49665/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49669/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49672/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 49673/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49674/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49685/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49688/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 53370/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 61192/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Microsoft Windows Server 2022 (96%), Windows Server 2019 (95%), Microsoft Windows 10 1703 (93%), Microsoft Windows 10 1703 or Windows 11 21H2 (93%), Windows Server 2022 (93%), Microsoft Windows Server 2016 or Server 2019 (93%), Microsoft Windows 10 1511 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windows Server 2016 (93%), Microsoft Windows Server 2019 (93%) No exact OS matches for host (test conditions non-ideal). ``` Domain : trusted.vl・trusteddc.trusted.vl 最初の方針 * 匿名ログイン行ける？ * SMB * LDAP ### 匿名ログイン ```sh ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Trusted] └─$ nxc smb 10.10.211.229 -u 'guest' -p '' --shares SMB 10.10.211.229 445 TRUSTEDDC [*] Windows Server 2022 Build 20348 x64 (name:TRUSTEDDC) (domain:trusted.vl) (signing:True) (SMBv1:False) SMB 10.10.211.229 445 TRUSTEDDC [-] trusted.vl\guest: STATUS_ACCOUNT_DISABLED ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Trusted] └─$ nxc ldap trusteddc.trusted.vl -u 'guest' -p '' --users LDAP 10.10.211.229 389 TRUSTEDDC [*] Windows Server 2022 Build 20348 (name:TRUSTEDDC) (domain:trusted.vl) LDAP 10.10.211.229 389 TRUSTEDDC [-] trusted.vl\guest: STATUS_ACCOUNT_DISABLED ``` 匿名ログインできない ### whatweb ```bash ``` ### Feroxbuster ```bash ``` ### Dirsearch ```bash ``` ### FFUF ```bash ``` ### WebSite * * * ### WebSite Screenshot ## Foothold ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ## Lateral Movement <横方向の動きに関する説明をここに書いてください> ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ## Privilege Escalation ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ```bash ``` ### Notes <このWriteupで特に重要な点や学んだことを追加で記載するセクション>