# Keeper

## Credentials

| Username  | Password          | Description                    |
| --------- | ----------------- | ------------------------------ |
| root      | password          | default RT credentials for web |
| lnorgaard | Welcome2023!      | User description in RT         |
| keepass   | rødgrød med fløde | dumped from memory             |

## Enumeration

### Nmap

```
# Nmap 7.94 scan initiated Tue Sep 26 15:50:48 2023 as: nmap -p22,80 -A -oA nmap/fullscan 10.10.11.227
Nmap scan report for 10.10.11.227
Host is up (0.038s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA)
|_  256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 2.6.32 (96%), Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 - 5.4 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 22/tcp)
HOP RTT      ADDRESS
1   36.88 ms 10.10.14.1
2   36.98 ms 10.10.11.227

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Sep 26 15:50:59 2023 -- 1 IP address (1 host up) scanned in 11.50 seconds

```

### WebServer

According to this forum thread [Forum](https://forum.bestpractical.com/t/default-password/20088) default password is `password` and login is `root` as mentioned in first answer.

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2F4Bo496GRbiA056pSLP6Z%2FPasted%20image%2020230926215500.png?alt=media&#x26;token=864c248d-06d2-412b-a0db-461da1986f3e" alt=""><figcaption><p>Login page of RT</p></figcaption></figure>

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2FY4f1DmvEXxio1k7l14JK%2FPasted%20image%2020230926220230.png?alt=media&#x26;token=ef23f181-ac05-412b-ab2d-f9a470eb3bb9" alt=""><figcaption><p>Successful login with default credentials</p></figcaption></figure>

After searching through portal, one user `lnorgaard` have plaintext password in description field. `Welcome2023!`

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2FG0okK4NmbCt2Fl1Q7BJ8%2FPasted%20image%2020230926222204.png?alt=media&#x26;token=6b7f776b-d4d3-4935-a3dc-6b27995b7361" alt=""><figcaption><p>data of lnorgaard user</p></figcaption></figure>

This set of credentials allowed for login in SSH

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2FLDS8DfvqlVkPIWrfkIly%2FPasted%20image%2020230926222412.png?alt=media&#x26;token=02a3c997-f14c-4eb3-a960-3d966c1e4e1b" alt=""><figcaption><p>Login through SSH</p></figcaption></figure>

### Privilege Escalation

User have `RT30000.zip` file, after unzipping it inside there are memory dump and keepas database.

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2FWr2c7N9AFmXdQUAAW5i3%2FPasted%20image%2020230926230300.png?alt=media&#x26;token=a6b4b292-0bc6-4fbb-8b3b-5104d9136574" alt=""><figcaption></figcaption></figure>

There was one vulnerability that allow dumping `master password` from memory, researcher that discovered this vuln shared a PoC:

{% embed url="<https://github.com/vdohney/keepass-password-dumper>" %}

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2F53m93HgrFBRcigvEeq83%2FPasted%20image%2020230926230414.png?alt=media&#x26;token=9209bfb5-f1da-4362-ab74-f1cd02336d54" alt=""><figcaption><p>Partialy recovered master password</p></figcaption></figure>

After googling whats was dumped correctly it is some kind of dessert

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2F1TOqhTYMXQwAHNuDTRbX%2FPasted%20image%2020230926230504.png?alt=media&#x26;token=2e7a5bc1-6fa5-40c6-94b3-61b7f582a056" alt=""><figcaption></figcaption></figure>

So password is `rødgrød med fløde`. Inside keepass there is some kind of ssh key in putty format.

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2F7x4DvccFRxDWykyDqwux%2FPasted%20image%2020230926230743.png?alt=media&#x26;token=ee254543-20a7-4c9b-9f82-df2511f84040" alt=""><figcaption></figcaption></figure>

This can be converted to `PEM` key with one command as shown here:

{% embed url="<https://tecadmin.net/convert-ppk-to-pem-using-command/>" %}

```bash
puttygen key -O private-openssh -o root.key
```

This allowed for login to `root` account with converted key.

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2FusXB6FaGQ1MJ34cKzofF%2FPasted%20image%2020230926230927.png?alt=media&#x26;token=5094aa11-56d3-48d2-8f4c-26290614423e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://133742081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnToeJfxVb7jBS1Pupch%2Fuploads%2Ftg2tF3W89pMbGTvREP4r%2Fec0532d0a6db947f62f0daf02e8921d9.gif?alt=media&#x26;token=c376ee8a-f0ee-4926-a039-47e451024016" alt=""><figcaption><p>Rooted box</p></figcaption></figure>