Hi there ! This is Mirai Hack The Box Writeup - Linux box - Easy

Summary :

• nmap
• gobuster
• ssh
• grep

Enumeration :

At first nmap the box. Got several ports, lets check port 80 (HTTP) there is nothing, just a blank page.

So check the directory with gobuster, I got /admin and /swfobjects.js, admin seems legit for my foothold. When i checked the js file, i got nothing.

This is the /admin page, I got Pi-hole login page. I didn’t know the credentials yet, when I google the default credentials for Pi-hole it returns user : pi, password : raspberry. but when I tried the credentials, it doesn’t work.

Foothold :

Then I tried the ssh port with the default credentials “pi@10.10.10.48” password : raspberry. Yep! I’m inside the box!!

User :

User Flag

Privilege Escalation :

So this “pi” user can do anything on this box, see the privileges on sudo -l. Sudo su works in here, but the flag is accidentally deleted and there is a message that the root flag is on usb stick.

Move to the /media/usbstick, use grep for take the “accidentally” deleted files.

Root :

Yes! I got the root flag!

KEEP LEARNING! CIAO! If you want to keep in touch with me, check the link below ~ see ya !