Keeper

Summary

#

Keeper is a tidy demonstration that “Easy” does not mean “unrealistic.” A support ticket portal is running on default credentials; inside it, a user’s password sits in a ticket in plain text. That user’s home directory holds a KeePass database dump — and a then-current CVE lets you recover the master password almost in full from that dump. The database contains an SSH key for root.

Recon

#

nmap -sC -sV -oA nmap/keeper 10.10.11.227

Just SSH and HTTP. The web server redirects to a hostname, so add it to /etc/hosts and follow it to a Request Tracker login page.

Foothold: default credentials

#

Request Tracker ships with a well-documented default administrative login. It was never changed here.

Inside, the admin can browse users. One user’s account has their password sitting in a comment field in clear text — and it is reused for SSH.

ssh lnorgaard@10.10.11.227

Enumeration

#

The home directory contains a ZIP holding a KeePass database (.kdbx) and a .dmp — a memory dump of the KeePass process taken during a crash.

The CVE

#

CVE-2023-32784: KeePass 2.x before 2.54 leaves the master password recoverable from process memory, one character at a time, minus the first character. A public proof-of-concept extracts the rest.

python3 keepass-dump-masterkey.py keeper.dmp
# recovers all but the first character

The recovered fragment is an unusual word; guessing the missing first character and correcting the obvious non-ASCII substitution gets the master password on a couple of tries. It unlocks the database.

Root

#

The database entry for root holds not a password but a PuTTY private key. Convert it to the OpenSSH format and log in.

puttygen keeper.ppk -O private-openssh -o id_rsa
chmod 600 id_rsa
ssh -i id_rsa root@10.10.11.227

Lessons

#

Every single step here is a real-world failure, not a CTF contrivance: an unchanged default admin password, a credential pasted into a support ticket, password reuse between the app and SSH, and a password manager left a version behind a known CVE. The box is “Easy” only because none of the steps needs custom exploitation — but the chain it models is exactly how real intrusions tend to actually go.