Mirai
Overview
Initial foothold : Default Credentials
Privilege Escalation : sudo rights
Enumeration
Start with port scanning
Start with web enumeration
Web Enumeration
Visit the webpage
Unable to see the contents of the webpage
Lets add the mirai.htb hostname into our host file
Now visit the webpage using this hostname
It looks like website is blocked for our ip and something whitelist things is running
See the source code of the website
Got some interesting directory
Visit /admin/ directory
Pi-hole console was running here
There was also login page which requires some password
Google Pi-Hole with its version for finding what exactly it is
After searching for default password got that the default username for ssh logging if Pi and password is raspberry
Exploitation
Got ssh credentials Pi : raspberry
try this creds on ssh login
Yeah ! we got shell as user pi
Privilege Escalation
Run sudo -l command
Here it is clear that we can run any command as root user
In this way we got root shell
Oo there wasn't the hash of root.txt file. But it was pointing us towards usb stick
Lets visit /media/usbstick
but after visiting /media/usbstick/ we haven't found any root.txt file
It must have deleted. We can confirm it by damit.txt file
For getting trash content we will use below command
here was the content of root.txt file
That's all for this box
Good Bye :)
Last updated