Hackthebox Keeper

Initial Enumeration

nmap

sql

# Nmap 7.93 scan initiated Sun Aug 13 18:46:24 2023 as: nmap -sC -sV -oN nmap/keeper keeper.htb
Nmap scan report for keeper.htb (10.129.203.52)
Host is up (0.24s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3539d439404b1f6186dd7c37bb4b989e (ECDSA)
|_  256 1ae972be8bb105d5effedd80d8efc066 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Aug 13 18:46:41 2023 -- 1 IP address (1 host up) scanned in 17.18 seconds

Web

Lets add tickets.keeper.htb to /etc/hosts

With default creds root:password we are able to login to the system

avrasm

lnorgaard:Welcome2023!

User

Privilege Escalation

https://github.com/CMEPW/keepass-dump-masterkey

powershell

rødgrød med fløde