# Keeper

Hack-The-Box 36 / 72
3 min read
HTB Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks. SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector.
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Keeper
  • OS type: Linux
  • Difficulty: Easy

Port Scanning - Service & Version Enumeration

Terminal window
  PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKHZRUyrg9VQfKeHHT6CZwCwu9YkJosNSLvDmPM9EC0iMgHj7URNWV3LjJ00gWvduIq7MfXOxzbfPAqvm2ahzTc=
|   256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBe5w35/5klFq1zo5vISwwbYSVy1Zzy+K9ZCt0px+goO
80/tcp open  http    syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
| http-methods:
|_  Supported Methods: GET HEAD
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80/HTTP

i’ll start my enumeration from port 80, by visiting site in the firefox

image.png

i’ll quickly add the tickets.keeper.htb in /etc/hosts file

and then i’ll visit the the tickets.keeper.htb and i found the login page

image.png

i’ll immediately search for the default credentials

image.png

i found the default credentials - root:password

let’s login to application

image.png

we are in.., enumerating the request tracker applicaiton after login, i found the users section and there was a user named lnorgaard when we click on the username we found password on it’s comment section

found the credentials inorgaard:Welcome2023 !

what now! yes SSH to the machine as inorgaard

Terminal window
ssh **inorgaard@10.10.11.227**
image.png

Post-Enum

Sudo -l

i’ll always first check for sudo permissions using sudo -l

image.png

check for the SUID binaries

Terminal window
find / -type f -perm -4000 2>/dev/nul
image.png image.png

the SMTP is running internally so it is worth to check the mail, /var/mail/lnorgaard

image.png

ticket id shows is 300000

visit the request tracker again and go to Search > Tickets > Simple search

image.png

enter the ID and click on search

reading the thread i found the useful information

image.png

it says that user saved the keepass crashdump in user’s home directory

image.png

i’ll start the python3 server on target machine using python3 -m http.server 8000

and use wget from kali to transfer RT30000.zip file to kali

image.png

unzip the file

image.png

i found the Dump of the keepass and the keepass database, after some searching on google i found that we can extract master password from the dump file

https://github.com/JorianWoltjer/keepass-dump-extractor

install tool using cargo install keepass-dump-extractor

image.png

create a hash of the database file that we can use to crack the hash

Terminal window
keepass2john keepass.kdbx > keepass.hash

crack the hash using hashcat after modifying the hash and remove the keepass word

image.png image.png

use the master password → rødgrød med fløde

image.png

Bingo!! we found root password, but ssh not working

image.png

also i found the private key in the notes section, upon searching google i found that we can use this key with putty tool to connect with ssh save the file with .ppk extension run putty with putty

image.png

to add the private key for authentication go to Window > Connection > SSH > Auth > Credentials and browse for the file and upload the key file here

image.png

click on open

image.png

and got SSH as root!

image.png
Next: Knife
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Bastion

Hack-The-Box 8 / 72
4 min read

Windows Easy machine - Bastion.

HTB Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). PHP NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks.

# Help

Hack-The-Box 28 / 72
7 min read

Linux Easy machine - Help.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). PHP File Upload ⓘ A vulnerability where unrestricted file uploads let an attacker plant a web shell or malicious script. SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector.

# Knife

Hack-The-Box 37 / 72
4 min read

Linux Easy machine - Knife.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Docker ⓘ A containerization platform — misconfigured sockets or escapes can lead to host compromise. MySQL Git SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector.

# Soccer

Hack-The-Box 64 / 72
6 min read

Linux Easy machine - Soccer.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP MySQL SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector. SQLi ⓘ SQL Injection — manipulating database queries via unsanitized input to read or alter data.
Comments