Safe @ HackTheBox
Safe is an “easy” machine on hackthebox, involving a simple buffer overflow and cracking a keepass file.
User Flag
We use ropstar, get a shell and the user flag.
Root Flag
Using keepass2john we generate a hash file for every image:
keepass2john -k <img> MyPasswords.kdbx > hash
We run rockyou-75.txt against it and find the password “bullshit” rather quickly. Inside the keepass file we find roots password “u3v2249dl9ptv465cogl3cnpo3fyhk”. Now we add our ssh key to “user”, ssh into the box and su to root.
