> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/keeper-hackthebox-writeup.md). # Keeper HackTheBox 复盘 Keeper HackTheBox 简单 Linux 机器复盘，涵盖滥用 Request Tracker、信息泄露、通过内存转储获取 KeePass 密码（提权），并包含实用的枚举、e {% embed url="" %} {% hint style="warning" %} **技能：** * 滥用 Request Tracker * 信息泄露 * 通过内存转储获取 KeePass 密码（权限提升） {% endhint %} ## 侦察 **工作区设置：** 通过创建三个文件夹来设置工作区，用于存放重要内容、漏洞利用和 Nmap 侦察结果。

**VPN 连接检查**/ 检查 VPN 连通性，以确保与目标主机的稳定通信。

**使用 Nmap 搜索开放端口：22、80** ```bash nmap -p- --open -n -Pn -vvv --min-rate 5000 10.10.11.227 -oG allPorts ```

**使用 Nmap 扫描端口版本：** 使用 Nmap 扫描端口版本，并将信息提取到“targeted”文件中： ```bash nmap -sCV -p22,80 10.10.11.227 -oN targeted ```

### 端口 80 我们发现了域名 **keeper.htb** 以及一个子域名 **tickets.keeper.htb**.

我们将它们添加到 `/etc/hosts` 文件：

## Request Tracker CMS 访问 **tickets.keeper.htb** 我们找到了一个管理面板。

我们测试 **Request Tracker**: ```plaintext 用户名：root 密码：password ```

连接成功！

在 **管理员 → 用户** 部分中我们找到了一个用户账户： * 用户： * 密码：Welcome2023!

#### SSH 连接我们使用找到的凭据通过 SSH 连接： ```bash ssh Inorgaard@keeper.htb ```

### user.txt 标志 :)

## 权限提升 ### **KeePass 数据库转储** 我们找到了一个 ZIP 文件 `RT30000.zip` 我们将其下载到本机： ```bash python3 -m http.server 8080 ``` ```bash wget http://10.10.11.227:8080/RT30000.zip ```

解压后，我们得到： * **KeePassDumpFull.dmp** * **passcodes.kdbx**

我们尝试打开 `passcodes.kdbx` 使用 KeePassXC： ```bash keepassxc passcodes.kdbx ``` 它要求输入密码。我们尝试使用 **John The Ripper**进行暴力破解，但没有成功。

### **Keepass - 内存转储分析** {% embed url="" %} 我们利用 `.dmp` 文件，使用一个 Python 脚本： ```bash python3 poc.py KeePassDumpFull.dmp ``` 这揭示了一些无法读取的字符。通过在线搜索，我们找到一个可能的密码：

**结果**：红色粥配奶油

我们使用这个密码解锁 KeePass，得到了一个 **PuTTY 加密密钥和 root 密码**.

### 将 PuTTY 密钥转换为 OpenSSH 格式我们需要将 PuTTY 密钥转换为 OpenSSH 格式： ```bash puttygen key.ppk -O private-openssh -o id_rsa ``` 接下来，确保你的私钥具有正确的权限： ```bash chmod 600 id_rsa ``` #### **连接到 SSH 服务器** ```bash ssh -i id_rsa root@10.10.11.227 ```

### root.txt 标志 :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/keeper-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.