Keeper

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Keeper (Windows, attack surface: OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0) (22), nginx 1.18.0 (Ubuntu) (80)). Foothold via the vulnerable entry point; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.227 --min-rate 1000

Enumeration highlights

• Detected OS: Windows.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sVC 10.10.11.227 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.227 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-07 06:14 PDT
Nmap scan report for keeper.htb (10.10.11.227)
Host is up (0.030s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3539d439404b1f6186dd7c37bb4b989e (ECDSA)
|_  256 1ae972be8bb105d5effedd80d8efc066 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.01 seconds

1. Based from the nmap results, we know that the machine runs a web application and opens ssh login.

2. To open the subdomain --> tickets.keeper.htb, we need to add that hostname to /etc/hosts first.

tickets.keeper.htb

1. Noticing there's no register option, I searched on the internet for request tracker default cred.

2. Let's use the cred --> successfully logged in as root!

3. Long story short, we can see all the user by open the navbar admin --> users --> select.

4. As we can see there's a user named lnorgaard.

5. Since the machine opens a ssh login, seems we need to login as lnorgaard.

6. Anyway, if you clicked the username and scrolls down to the comment section.

7. You shall find a password hardcoded there.

8. Let's login.

LOGIN AS lnorgaard

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.