---
# System prepended metadata

title: KEEPER HTB WRITE-UP SEASON 2
tags: [KEEPER WRITTEUP FROM HTB]

---

hello hackers am back again, lets have a simple walkthroug with an easy box from SEASONAL 2 of hacking with HACK THE BOX, i was scared writting the writteups with these machine to avoid get suspendend  from hacking.

As usually with hacking or pentesting methodology is what will save you.

lets begin hackers

**STEP 1: SCANNING**

![Screenshot from 2023-11-22 23-34-09](https://hackmd.io/_uploads/ryNX8k346.png)


as you can see above we have got two open port open but filtered mhmmmmmmmm.

**STEP 2: ENUMERATION**

Lets start enumerating one port after another

Port 22 is ssh, in order to access it we need credentials and we dont have here so we need to find another way in the target machine.

Port 80 is running http but seems is filtered, I was first scared since because if is the port is in filtered state we need to find a way to bypass it inorder to reach to the server, if we try to browser to the ip under port 80 it can be accessed men that was real cool for sure.

**STEP 3: EXPLOITATION 3**

![Screenshot from 2023-11-22 23-46-06](https://hackmd.io/_uploads/ryliu13N6.png)

It seems that we got here a domain and a subdomain lets add it to our /etc/hosts

![Screenshot from 2023-11-22 23-47-33](https://hackmd.io/_uploads/S1reFJnNT.png)


And when we try to click the redirection link it takes us to a login page 


![Screenshot from 2023-11-22 23-48-25](https://hackmd.io/_uploads/SyRmYJhE6.png)

The login page looks cool but i didn't want to go direct and try some other methodology of bypassing the login page, i knew that with this login page i dont need to brute force just some simple trick, normally HTB is trick so i started looking what is suspicious here with the login page.

You can google what is RT, and since we have a login page you can also try this one "RT defaults creds"

![Screenshot from 2023-11-22 23-56-53](https://hackmd.io/_uploads/S1BUoJhET.png)

username:root
password:password


and try to input the creds 

![Screenshot from 2023-11-22 23-59-39](https://hackmd.io/_uploads/Byyy3kh46.png)


Just found myself in, reall cool and hapy 

![Screenshot from 2023-11-23 00-06-53](https://hackmd.io/_uploads/B132p13N6.png)


If we check the Admin section there you can find something useful and cool, its the domain and username


![Screenshot from 2023-11-23 00-15-12](https://hackmd.io/_uploads/HJXK1enE6.png)

And finally we got something usefully 
its a username and upon looking around found this 

![Screenshot from 2023-11-23 00-18-28](https://hackmd.io/_uploads/rykLxgn4a.png)


**STEP 4: FOOTHOLDING**
since we got the ssh creds we can try to gain remote access via ssh to the target machine. 

email:lnorgaard@keeper.htb
password:Welcome2023!

![Screenshot from 2023-11-23 00-31-06](https://hackmd.io/_uploads/rJE8XgnNp.png)

**STEP 5: PRIVILEGE ESCALATION**

Lets have some fun time with root,it was really cool and simple


![Screenshot from 2023-11-23 07-49-39](https://hackmd.io/_uploads/B1AWjUhE6.png)

remember we saw a .zip file lets transfer to our local machine and have some deep diving with it.

![Screenshot from 2023-11-23 07-58-55](https://hackmd.io/_uploads/S18Q283NT.png)

Oky here we see two files, but the first dump file is the one contains the passcode for our way toward the database, so we need to dump theDumpFull.dmp file and see if we can get a passcode for the kdbx db.

After some search found the PoC and made a fork to myself so as i can easy get to it.

https://github.com/alien-keric/keepass-dump-masterkey.git

With the python script we can try to dump the keepass master-key like this 

![Screenshot from 2023-11-23 08-10-14](https://hackmd.io/_uploads/SJPTA8hET.png)

command: python poc.py KeePassDumpFile.dmp

Seems as some characters are missing here , i tried to google and see if i can get them.

![Screenshot from 2023-11-23 08-12-46](https://hackmd.io/_uploads/Sy9Dyw3ET.png)

**passcode**: Rødgrød med Fløde (rødgrød med fløde)

NB: if you try the name as it is you actuall get an error so u need to change the uppercase letter into small letters and then submit it.

![Screenshot from 2023-11-23 08-31-48](https://hackmd.io/_uploads/S1zerD2Ea.png)


Opening the passcode.kdbx in windows is very simple but in linux you can just try to download a keepass2 so as to be able to open this file.

After submitting our passcode we get some files.

![Screenshot from 2023-11-23 08-38-08](https://hackmd.io/_uploads/BJ0DBP3Vp.png)

And if we click the first file you you  will get this output

![Screenshot from 2023-11-23 08-39-35](https://hackmd.io/_uploads/BJYpBw2Na.png)


Now the waiting is over, we see above under the notes section we have .perm file lets find a way we can convert to a .ppk file format

You can check here

https://repost.aws/knowledge-center/ec2-ppk-pem-conversion

NB: the main idea toward privilege escalation is ppk2pem.

first of all u have to install putty tools

**command**:sudo apt-get install putty-tools


And after that you can use the following command to convert the file

**command**: puttygen rsa.ppk -O private-openssh -o output.perm

![Screenshot from 2023-11-23 14-39-23](https://hackmd.io/_uploads/B1nG532Na.png)


And from there you can go and grab the flag of the root access

![Screenshot from 2023-11-23 14-41-28](https://hackmd.io/_uploads/ryyJin3Va.png)

The machine was cool and really simple 













