{"id":75,"date":"2026-01-20T12:08:46","date_gmt":"2026-01-20T12:08:46","guid":{"rendered":"https:\/\/patatties.nl\/?p=75"},"modified":"2026-01-20T15:39:40","modified_gmt":"2026-01-20T15:39:40","slug":"htb-keeper","status":"publish","type":"post","link":"https:\/\/patatties.nl\/?p=75","title":{"rendered":"HTB: Keeper"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

A Linux box this time. We’re slowly working our way up. A bit more recent machine this time.<\/p>\n\n\n\n

Lets start again with a Ping and nmap of all ports.<\/p>\n\n\n\n

nmap -p- -sC -sV 10.129.229.41<\/p>\n\n\n\n

Only 2 ports open<\/p>\n\n\n\n

PORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA)\n|_  256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519)\n80\/tcp open  http    nginx 1.18.0 (Ubuntu)\n|_http-title: Site doesn't have a title (text\/html).\n|_http-server-header: nginx\/1.18.0 (Ubuntu)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\n\n\n
Main page simply says to rais a ticket, but also exposes the tickets subdomain. So lets add that to the hosts file, and open.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We are greeted by the ticketing system.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Capturing a sign-in POST with burpsuite i tried to see if any of the fields are SQL injectable using SQLMAP:<\/p>\n\n\n\n
POST \/rt\/NoAuth\/Login.html HTTP\/1.1\nHost: tickets.keeper.htb\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:140.0) Gecko\/20100101 Firefox\/140.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 57\nOrigin: http:\/\/tickets.keeper.htb\nConnection: keep-alive\nReferer: http:\/\/tickets.keeper.htb\/rt\/\nCookie: RT_SID_tickets.keeper.htb.80=acf955e350c85ca2764ea39c9283495d\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\nuser=user&pass=pass&next=c91d1e2a59351c19648436b3c1740a6e\n\n## put this into sqlmap.txt<\/code><\/pre>\n\n\n\n
sqlmap -r sqlmap.txt -p next --dump --ignore-code=404 --risk=3\n<\/code><\/pre>\n\n\n\n
No luck there!<\/p>\n\n\n\n
Guessing the password for an admin user, also no luck. The logon form exposes some system information: RT 3.3.3+dfsg-2ubuntu1 (debian). Perhaps a vulnerability?<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
There seems to be an SQL injection for ShowPending. Lets have a closer look!<\/p>\n\n\n\n
Hm, seems to be outdated, or at least authenticated, but lets give it a try nonetheless. We have our post request, so it only takes a couple of minutes.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
No dice! Maybe later.<\/p>\n\n\n\n
For now, lets look up the factory default credentials, if they exist. According to a short google search these should be root:password.<\/strong><\/p>\n\n\n\n
Dice! They worked! We’re in!<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\n\n\n\n
So what now. Lets have a look around. There is another user on this system: lnorgaard@keeper.htb, and they have a note at their account:<\/p>\n\n\n\n
New user. Initial password set to Welcome2023!<\/code><\/pre>\n\n\n\n
Not sure wat to do with this, i would think that root would have all access.<\/p>\n\n\n\n
\n\n\n\n
Looking around i se a bunch of errors, but not really any new leads. So i logged on with lnorgaard:Welcome2023!<\/strong><\/p>\n\n\n\n
This indeed still worked! We come to the website in Danish, but immediately we see a ticket with issues for keepass. Keepass, passwords, interesting!<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Opening the Issue we have a message about a keepas crash dump. Very interesting! <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Looking around i dont seem to find the download attachment button for this ticket. Apperently they are saved in the database somehow. Also, it seems that Root has created this ticket. Maybe it has hidden dat data somewhere?<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Apperently the attachment was removed, but placed in the home directory. Is this user also a user on the box? Lets check it out.<\/p>\n\n\n\n
Success!<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\n\n\n\n
When unzipping the RT3000.zip we find 2 files inside:<\/p>\n\n\n\n