Keeper — HTB Writeup | The Hack Sparrow

Executive summary — Keeper is a very current Easy Linux box built around secrets management: a Request Tracker (RT) ticketing system with a default admin account lets us read a ticket containing lnorgaard's initial password. In their home there's a memory dump of a running KeePass process and the .kdbx database; with CVE-2023-32784 we reconstruct the master password from the dump, and automating the database with pykeepass surfaces root's private SSH key, stored in PuTTY format. An RT → lnorgaard → KeePass dump (CVE) → root's key → root path.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.229.41`

Attack map

[80] Request Tracker (RT) → default credentials root:password
   │  ticket reveals lnorgaard's initial password (Welcome2023!)
   ▼
[SSH]  lnorgaard
   │  home: KeePassDumpFull.dmp + passcodes.kdbx
   │  CVE-2023-32784 (keepass-dump-masterkey) → master: "rødgrød med fløde"
   ▼
[KeePass]  pykeepass automates the search → root's SSH key (PuTTY .ppk)
   ▼
[ROOT]  puttygen → OpenSSH → ssh root  (root.txt · user.txt)

1. Reconnaissance

nmap -sC -sV 10.129.229.41

22/tcp open  ssh
80/tcp open  http

Only two open ports: SSH and HTTP. With such a small attack surface, the entry point can only be the web application on port 80.

Resumen ejecutivo — Keeper es un Linux Easy muy actual centrado en la gestión de secretos: un sistema de tickets Request Tracker (RT) con credenciales de administrador por defecto deja leer un ticket con la contraseña inicial de lnorgaard. En su home hay un volcado de memoria de un proceso KeePass y la base .kdbx; con CVE-2023-32784 se reconstruye la contraseña maestra a partir del volcado, y automatizando la apertura de la base con pykeepass aparece la clave SSH privada de root, guardada en formato PuTTY. Recorrido RT → lnorgaard → volcado de KeePass (CVE) → clave de root → root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.229.41`

Mapa del ataque

[80] Request Tracker (RT) → credenciales por defecto root:password
   │  ticket revela la contraseña inicial de lnorgaard (Welcome2023!)
   ▼
[SSH]  lnorgaard
   │  home: KeePassDumpFull.dmp + passcodes.kdbx
   │  CVE-2023-32784 (keepass-dump-masterkey) → master: "rødgrød med fløde"
   ▼
[KeePass]  pykeepass automatiza la búsqueda → clave SSH de root (PuTTY .ppk)
   ▼
[ROOT]  puttygen → OpenSSH → ssh root  (root.txt · user.txt)

1. Reconocimiento

nmap -sC -sV 10.129.229.41

22/tcp open  ssh
80/tcp open  http

Solo dos puertos abiertos: SSH y HTTP. Con la superficie tan reducida, el punto de entrada solo puede estar en la aplicación web del puerto 80.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.