search

Keeper

# Nmap 7.93 scan initiated Tue Aug 22 01:27:53 2023 as: nmap -p22,80,8000 -sV -sC -T4 -oA keeper-nmap keeper.htb
Nmap scan report for keeper.htb (10.10.11.227)
Host is up (0.069s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3539d439404b1f6186dd7c37bb4b989e (ECDSA)
|_  256 1ae972be8bb105d5effedd80d8efc066 (ED25519)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.18.0 (Ubuntu)

Open Ports :

  • port 22 ssh

  • port 80 web htttp

Port 80 redirected to another subdomain

# add it to /etc/hosts
10.10.11.227    keeper.htb tickets.keeper.htb

Google request tracker default credential

Admin -> User -> Select (To list all users)

  • Hinted the user is from Danish

foothold

listing directory

  • We are hinted that is is vulnerable to KeePass CVE

  • dmp suggest that it might be vulnearble to memory dump CVE

Priv Esc

Execution

Google the masterkey password

Open passcode.kdbx wtih KeePass

Convert PuTTY to OpenSSH

  • The reason you need to convert a PuTTY .ppk private key to a PEM format (.pem file) before using it with the ssh -i command is due to the differences in key formats used by PuTTY and OpenSSH.

  • In nutshell : Windows uses PuTTY but linux use OpenSSH

root

PreviousBankNextHelp

Last updated