Keeper_SSH

SSH

---

After accessing the administrative panel of the target web application, I found out that there is a CLEARTEXT password hard-coded into the comment section of the lnorgaard user. While the credential has failed to authenticate to the web application itself, I will test it out against the SSH server

┌──(kali㉿kali)-[~/archive/htb/labs/keeper]
└─$ sshpass -p 'Welcome2023!' ssh lnorgaard@keeper.htb                                                         5 ⨯
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-78-generic x86_64)
 
 * documentation:  https://help.ubuntu.com
 * management:     https://landscape.canonical.com
 * support:        https://ubuntu.com/advantage
failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
 
You have mail.
last login: Mon Aug 14 16:05:52 2023 from 10.10.14.20
lnorgaard@keeper:~$ whoami
lnorgaard
lnorgaard@keeper:~$ hostname
keeper
lnorgaard@keeper:~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.11.227  netmask 255.255.254.0  broadcast 10.10.11.255
        inet6 dead:beef::250:56ff:feb9:58e5  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::250:56ff:feb9:58e5  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:b9:58:e5  txqueuelen 1000  (Ethernet)
        RX packets 1044397  bytes 167277030 (167.2 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1401292  bytes 661981797 (661.9 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 2563658  bytes 371374642 (371.3 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2563658  bytes 371374642 (371.3 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Password reuse confirmed for the lnorgaard user Initial Foothold established to the target system as the lnorgaard user via SSH