【TryHackMe】Windows Command Line：Walkthrough

# 概要

TryHackMe「Windows Command Line」のWalkthroughです。

https://tryhackme.com/r/room/windowscommandline

# Task1

## **Q1**.*What is the default command line interpreter in the Windows environment?*

**A**.**cmd.exe**

# Task2

## **Q1**.*What is the OS version of the Windows VM?*

ターゲットマシンにSSH接続するとバージョン情報が表示されました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/676b85b6-c76f-5790-9d4a-37e8e840f16f.png)

**A**.**10.0.20348.2655**

## **Q2**.*What is the hostname of the Windows VM?*

`hostname`コマンドで確認できます。

```
user@WINSRV2022-CORE C:\Users\user>hostname 
WINSRV2022-CORE
```

**A**.**WINSRV2022-CORE**

# Task3

## **Q1**.*Which command can we use to look up the server’s physical address (MAC address)?*

**Hint**.*Use ipconfig*

`ipconfig /all`コマンドで確認できます。

```
user@WINSRV2022-CORE C:\Users\user>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : WINSRV2022-CORE
   Primary Dns Suffix  . . . . . . . : 
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : eu-west-1.compute.internal
                                       eu-west-1.ec2-utilities.amazonaws.com

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : eu-west-1.compute.internal
   Description . . . . . . . . . . . : Amazon Elastic Network Adapter
   Physical Address. . . . . . . . . : 02-3E-68-F3-2B-29
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::a178:2475:f20b:5eb1%5(Preferred) 
   IPv4 Address. . . . . . . . . . . : 10.10.141.194(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Lease Obtained. . . . . . . . . . : Tuesday, January 21, 2025 6:14:53 AM
   Lease Expires . . . . . . . . . . : Tuesday, January 21, 2025 7:14:53 AM
   Default Gateway . . . . . . . . . : 10.10.0.1
   DHCP Server . . . . . . . . . . . : 10.10.0.1
   DHCPv6 IAID . . . . . . . . . . . : 84601211
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2D-B9-B7-EF-00-0C-29-FF-E5-C8
   DNS Servers . . . . . . . . . . . : 10.0.0.2
   NetBIOS over Tcpip. . . . . . . . : Enabled
```

**A**.**ipconfig /all**

## **Q2**.*What is the name of the process listening on port 3389?*

`netstat`コマンドで確認できます。

```
user@WINSRV2022-CORE C:\Users\user>netstat -abon

 Can not obtain ownership information
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       988
  TermService
```

**A**.**TermService**

## **Q3**.*What is the subnet mask?*

`ipconfig`コマンドで確認できます。

```
user@WINSRV2022-CORE C:\Users\user>ipconfig

Windows IP Configuration


Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : eu-west-1.compute.internal
   Link-local IPv6 Address . . . . . : fe80::a178:2475:f20b:5eb1%5
   IPv4 Address. . . . . . . . . . . : 10.10.141.194
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 10.10.0.1
```

**A**.**255.255.0.0**

# Task4

## **Q1**.*What are the file’s contents in C:\Treasure\Hunt?*

`C:\Treasure\Hunt\flag.txt`の内容を確認します。

```
user@WINSRV2022-CORE C:\Treasure\Hunt>more flag.txt
THM{CLI_POWER}
```

**A**.**THM{CLI_POWER}**

# Task5

## **Q1**.*What command would you use to find the running processes related to notepad.exe?*

`tasklist /fi <filter>`でフィルタリングできます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/11bd77aa-5729-00b9-8fd4-cc774a82efd1.png)

https://learn.microsoft.com/ja-jp/windows-server/administration/windows-commands/tasklist#parameters

**A**.**tasklist /FI "imagename eq notepad.exe"**

## **Q2**.*What command can you use to kill the process with PID 1516?*

**A**.**taskkill /PID 1516**

# Task6

## **Q1**.*The command shutdown /s can shut down a system. What is the command you can use to restart a system?*

**Hint**.*shutdown /? | more*

`/r`で再起動できます。

```
user@WINSRV2022-CORE C:\Treasure\Hunt>shutdown /?
    /r         Full shutdown and restart the computer.
```

**A**.**shutdown /r**

## **Q2**.*What command can you use to abort a scheduled system shutdown?*

`/a`で可能です。

```
/a         Abort a system shutdown.
           This can only be used during the time-out period.
           Combine with /fw to clear any pending boots to firmware.
```

**A**.**shutdown /a**