Keeper
Nmap Scan
$ nmap -sC -sV -Pn -oN nmap 10.10.11.227
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-27 09:14 +08
Nmap scan report for 10.10.11.227
Host is up (0.0067s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA)
|_ 256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.84 secondsInitial Access
Port 80
There is a website hosted on port 80. They only tell us to visit this webpage to raise an IT support ticket.
So I added tickets.keeper.htb into the host file.
After adding to the host file, I visited the website and it shows me this.
From the top right I can see that it is a Request Tracker and since this is a login page, I searched up for default credentials if there are any. After searching, there are default credentials for this software.
After trying the default username and password, I am able to login.
I will then go to the User tab under Admin to see if there is any other users.
From here, I can see there is another user called Inorgaard.
If I click into it, we can see that the password for the user lnorgaard is Welcome2023!
After trying the credentials, I am able to login into the system as lnorgaard.
Privilege Escalation
KeePass dump
When I check the local directory, I can see that there is a RT30000.zip folder.
I will then unzip the file to see what is the content of the zip.
The zip file contains the KeePassDumpFull.dmp and passcodes.kdbx. I will then extract out passcodes.kdbx.
However, when I tried to crack the password, it does not seems successful.
After searching online to see if there any uses for the KeePassDumpFull.dmp file, I can see that maybe we can get the master key password from the dump file instead.
After moving the dump file into the same folder as the poc script, I will run the script. However, there are multiple possible password.
However, there is a slight issue, this does not make sense. So i went to copy ●ldgr●d med fl●de into google and this is what i was returned.
So the possible password could be this: rødgrød med fløde
So I tried enter that as the master password for the keepass file
Sure enough, it works
Puttygen convert to openssh key
After clicking on root, we can see that there is a private key being inserted into the notes section.
I need to use puttygen to generate the private key. After which, I am able to login as root.
Last updated