ターゲット // Bounty
PlatformHTB
OSWindows
DifficultyEasy
IP10.129.X.X

Enumeration

Nmap

▶ Nmap output
PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 7.5
|_http-title: Bounty
|_http-server-header: Microsoft-IIS/7.5
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Port 80 - IIS 7.5

Directory fuzzing reveals two interesting hits: