HTB Keeper Writeup: How a Danish Dessert Unlocked Root Access

Initial Foothold: Web Application Vulnerability

Root Access: Privilege Escalation Path

Add given ip to host file keeper.htb

nano /etc/hosts

Conduct nmap scan ->

fast-forward full scope

nmap -sV -sC -T4 -p- 10.129.229.41

22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3

80/tcp open http nginx 1.18.0 (Ubuntu)

Only ports below were open.

No results for keeper.htb in fuzzing ->

Let’s check port 80

Simple html with referencing another page let’s add this also hosts file.

Now I conducted fuzzing on tickets.keeper.htb subdomain.

Jump to /rt/ endpoint directly.

I did not see any exploit regarding to application login bypass via searchsploit. Therefore, I tried to search for default creds ->

On base endpoint / credentials did not work ,so I also applied on /rt/ so as to ensure myself to be in correct backend proxy position.

Now I am in admin dashboard. Enumerate users ->

Observe that user pass includes in comments section. Let’s connect through SSH.

Begin to see available binaries.

Took user flag:

Unzip zip file ->

unzip RT30000.zip

I searched for keepass keyword and found a repo related vulnerability -> CVE-2023–32784 https://github.com/z-jxy/keepass_dump

To analyze, retrieve files to local:

scp lnorgaard@keeper.htb:~/RT30000.zip /tmp/

clone the repo -> git clone https://github.com/z-jxy/keepass_dump?tab=readme-ov-file

unzip again and move .dmp, kdbx files to keepass-password-dumper directory

The process terminated ,yet I found really extraordinary string

dgrd med flde

Sent to search engine

The found string is a dessert ->

rødgrød med fløde

The string is associated with the master password of KeePass ,so I identified a apt package called keepass2 just by apt install keepass then it recommended correlated GUI tool.

Simply run the tool as keepass2 then click folder icon (open database).

Find and select passcodes.kdbx file

Now it will ask the master password which is rødgrød med fløde ->

Click no by default.

Simply click the masked password on root user

Now authenticate as root:F4><3K0nd!

It did not work. Notice Putty user key file can be seen here ->

Now I did not have previous experience on how to conver Putty user key file to SSH ,so I discovered such a useful resource about it.

https://superuser.com/questions/232362/how-to-convert-ppk-key-to-openssh-key-under-linux

I passed through private-openssh so as to connect via root user.

puttygen /home/kali/Desktop/putty.ppk -O private-openssh -o /home/kali/Desktop/root_id_rsa

Connect with private key ->

ssh -i root_id_rsa root@keeper.htb

Get the root flag ->

May The Pentest Be With You ! ! !