HackTheBox - Mirai - Retired - Updated

HackTheBox - Mirai - Retired

Recon

I've been using threader3000 lately for my recon scans. It does a staged scan the first scan is a simple fast up/down scan on all TCP ports. Then it suggests a nmap scan based on just the ports found open in the initial scan, it automatically saves the nmap scan as XML.

threader3000

I then convert the XML to HTML to make it easier to read.

xsltproc ./mirai.htb/mirai.htb.xml -o ./mirai.html

Let's see what we learn from this 

Nmap thinks its a debian based box.

Port 22 OpenSSH 6.7p1

Port 53 dnsmasq 2.76

Port 80 lighttpd 1.4.35

Port 1121 Platinum UPnp 1.0.5.13

Port 32400 Plex

Port 32469 Platinum UpnP 1.0.5.13

Looks like we have DNS running, SSH and some media server software.

Let's take a look at the webserver and see what we can find.

Website blocked by pi-hole?

If you are running a pi-hole on your network ( like yours truly) this is super confusing. I thought my pi-hole was block.. But then I saw the version number

Pi-Hole v3.1.4 

I'm running a new version so this is not my pi hole but something related to this box.

Well guess what? If you don't know a PI-Hole is a DNS you can run that you can use to block ads on and other sites from your local network.. So this must be what is going on on Port 53. 

Also if we don't use a DNS name then we don't go to that service so I just tried hitting it via IP address instead.

Now I just get a blank page… but at least it's not a pihole block message.

Let's run a brute force scan on the directories and files here at this IP address and see if we can find any other things it might be serving here.

dirb http://10.10.10.48

Dirb found an admin directory

If we try it, we get the admin panel for the pi-hole installation.

Here is the version information again.

So I googled around for an RCE exploit or LFI for plex or pi-hole that might help out here…

Then I googled the name of the box mirai.

Turns out this is the name given to a bot net that would use IOT devices, it would try to access them using the default credentials setup by the manufacturers.

https://en.wikipedia.org/wiki/Mirai_(malware)

So If this is running pi-hole there is a good chance this is a raspberryPI device… and they do come with a default login of 

Username: pi

Password: raspberry

Exploit

Let's see if we can login to the SSH using the raspberry PI default credentials.

ssh pi@10.10.10.48

And now we are inside the box.

And now we can get the user flag in the /Desktop folder of the user pi

One of the first things I always check on Linux boxes when I have a user account is their sudo privileges.

sudo -l

Wow pi can run anything as root with no password.. 

So we could just cat out the root.txt file from here.

sudo cat /root/root.txt

Tricky…. We get a note here about them moving the root.txt to a backup of a USB stick.

Well first let's get rid of the user pi and move to the root users. Since they can do any sudo without a password we can just

sudo su root

Now we can poke around and see if we can find that backup file.

Let's see what is connected to the machine.

df

Looks like there is a device /dev/sdb that is mounted on /media/usbstick

I moved to the /media folder and found a directory called usbstick

Inside there was a file named damnit.txt

root@raspberrypi:/media/usbstick# cat damnit.txt Damnit! Sorry man I accidentally deleted your files off the USB stick. Do you know if there is any way to get them back?

So we need to look for a deleted file on /dev/sdb?

If we ls in the lost+found folder we get nothing… 

However in linux "everything is a file" which means /dev/sdb is a file… and if it's a file…. We can cat it.

cat /dev/sdb

And here towards the end of the output we get our flag