Keeper
Linux box on HTB.
Enumeration:
Port Scanning:
We have only two ports, http on port 80, and ssh on port 22.
HTTP (80):
Lets open it with Firefox:
We have a blank page with a link refering to a subdomain, so I will add it to the hosts file:
Now lets navigate to that subdomain:
Here we can see a login page, with the version of the running service on the webserver.
We can try default credentials, like admin:admin:
We will get password is incorrect:
So we can search online for default credentials for that service:
Here it says, the user is root, and the password is password, lets try it out:
We logged in successfully.
After moving around, and navigating through the application, we will find a comment for the user lnorgaard:
Check if this is the correct password, and if this user is valid:
So we can ssh to the box:
Privilege Escalation:
We will find the user.txt in the home directory, and another file:
Download the file using scp:
Unzip it:
We can use kpclie to interact with the keepass database:
So we need a master password to interact with it.
I searched online for how can I open or interact with the keepass dump:
We will see multiple toos. talking about dumping the master passwrod from the dump file.
I downloaded one of the tools and tried to dump the password:
It seems like it is missing some characters, I tried another tool with the same result.
Lets search and find if this is a famous word or something:
We can see that this is a dessert, and those are the missing characters, we can use them to enter the keepass database, so we will paste this as a password rødgrød med fløde:
We successfully could enter the database.
We can navigate through the database:
So we have two entries inside the network group, we can view its values using get or show commands:
Here we have the password of lnorgaard user, lets check the other one:
I tried this password, but could not ssh as root.
But we can see that note that has putty ssh rsa, we can convert it to open ssh private key so we can ssh using it, but first save it to a file:
Convert it using puttygen:
Change its permissions:
Authenticate as root, and get the root flag:
Last updated