search

Mirai

#Linux #Raspberry #Enumeration #IoT

Mirai is an easy-rated Linux machine from HackTheBox arrow-up-rightcreated by Arrexel. It was weird to find nothing at the start. In this machine, it was essential to research elements, mainly because of its IoT orientation. In the current post, my IP is 10.10.14.20, and the target’s IP is 10.129.210.160.

hashtag
Gathering Information

First, we are going to start with checking if the machine is alive, then do the classic reconnaissance to get some general information about the target.

Local Terminal
ping -c 1 10.129.210.160

Pinging 10.129.210.160 with 32 bytes of data:
Reply from 10.129.210.160: bytes=32 time=145ms TTL=63
Reply from 10.129.210.160: bytes=32 time=146ms TTL=63
Reply from 10.129.210.160: bytes=32 time=147ms TTL=63
Reply from 10.129.210.160: bytes=32 time=151ms TTL=63

Ping statistics for 10.129.210.160:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 145ms, Maximum = 151ms, Average = 147ms

The TTL is 63, is close to 64 so it is a Linux Machine.

Local Terminal
nmap -p- --open -T5 -v -n 10.129.210.16 -oG AllPorts

Completed SYN Stealth Scan at 20:44, 49.81s elapsed (65535 total ports)
Nmap scan report for 10.129.210.160
Host is up (0.16s latency).
Not shown: 65529 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
53/tcp    open  domain
80/tcp    open  http
1501/tcp  open  sas-3
32400/tcp open  plex
32469/tcp open  unknown

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 50.30 seconds
           Raw packets sent: 68926 (3.033MB) | Rcvd: 68952 (2.758MB)

Here we have something inusual at the port 53, "dnsmasq 2.76", after some research about it, is just a Free Software Providing Domain Name System (DNS), with a big list of exploits, we will save it for later.

  • Browser: http://10.129.210.160

The website is empty, let's try with Curl.
Nothing relevant.

By using curl we get a new relevant information, "Pi-hole", after some research, I found that is an application to block adds and trackers, and is designed to work in embed devices with network availability, like a Raspberry Pi.

The information about being a Raspberry Pi was pretty hidden, so it is worth to try the default credentials at the SSH port {user: pi} {password: raspberry}.

We are in!

hashtag
Exploit?

Look what we found, group 27(sudo), we can use sudo to login again and try the default password... again!

The password wasn't necessary

A lot of folders to find the flag

And we have the first flag!

hashtag
Privilege Escalation

Now we are going to locate the target,

It is located it two paths, let's try with the usual first and then the new one.

Same message, we have to find a way to find that USB stick, with df -h, used to see the disk usage in a list format of an Linux Machine.

I tried with cat first, bad idea, I find a lot of illegible information, and then with cd /dev/, there are a lot of files. At this point the best option is to execute it, if it fails or we can't do anything, we can analize the file with strings

Aaaaand... the flag is in clear text, that was random; the machine is done.

PreviousLameNextNetworked

Last updated