Writeup: HackTheBox Mirai- Without Metasploit (OSCP Prep)
Tags: cybersecurity, hackthebox, webdev, security
Published: 2021-07-05 14:17:16

Hello Again All!

Here with another write up and this time it will be Mirai from HackTheBox.

**Difficulty level: Easy**

So lets begin!

#Command:
**Nmap -sC -sV -T4 -oN nmap.txt 10.10.10.48**

1. -sC = equivalent to --script=default
2. -sV = Probe open ports to determine service/Versions info
3. -T4 = Set timing for faster output (0-5)
4. -oN = Output to save it to a file

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jr0w6lrm6817qsmigw1y.JPG)

Open Ports displayed:
1. 22 OpenSSH
2. 53 DNSmasq
3. 80 Lighthttpd
4. 1185 Platinum

Let's head over to the website to see what is there.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nqcw8oqucno05x8p9sw3.PNG)

Nothing appears to display when going to the site so let's try the following.

#Command:
**Right-click** on the page.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m8z99xh8c6ynr17i1vay.PNG)

Still nothing is displaying.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bchz8iuixetexds9cf27.PNG)

Alright, lets check out the other ports open on the box.

#Command:
**ssh 10.10.10.48**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ljohjsl27y1eec7l6akt.PNG)
 
So no luck with trying to just SSH into the machine. I am going to run a nmap Vuln Scan on the machine to check.

#Command:
**Nmap --script vuln -oN vuln.txt 10.10.10.48**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bfgd2b8602yquyfsmmj9.PNG)

If you scroll down to the middle of the page there is a reference to something called "Pi-Hole".

I am going to try something else to see if anything comes up.

#Command:
**curl -vvv 10.10.10.48**

1. Simply curl or command-line tool and library for transferring data with URLs.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/79kw5uxxwj540h3jhbrx.PNG)

So we can now see again there is something with **"Pi-Hole"** going on here.

Directory Busting is usually helpful when trying to find hidden directories on a site.

#Command:
**dirb http://10.10.10.48**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mfckyxc82yfpkzemw6o9.PNG)

After a few minuets of this running we come back with a success with **/admin/**.


Great, lets now head over to the site to see if there is anything there.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fc7xd2l6h0gn78squg0v.PNG)

So if you never heard of **Pi-Hole** or **Pihole** this is a linux network-level advertisement and internet tracker blocking application which acts as a DNS Sinkhole and/or DHCP Server.

After playing around withthe site for a few minuets I head over to the **Login** landing page.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g0vt0kxpcpuq4mtwgu5l.PNG)

So I tried doing a few things here, attempted to use Hydra to gain access on the site as well as use hydra for the SSH login but no  luck. From here I head over to Google.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b7wdfn6e4p72hudcno0b.PNG)

So it looks like the Username/Password gets set to pi:raspberry.

I tried using this on the login page but that didn't work so I turned to the SSH login.

#Command:
**ssh pi@10.10.10.48**
**raspberry**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7zni089c0y8ksd1cvrkr.PNG)

Looks like we got our first access to the SSH server!

#Command:
**wc user.txt**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zosg8w4fg4zppj895fay.PNG)

Lets run some Sudo commands.

sudo **-l** will list the allowed and forbidden commands for the invoking user on the current host.

#Command:
**sudo -l**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xr4laaksvrs4i8w01g9e.PNG)

Welp that is interesting....

Alright I am going to try and switch users.

#Command:
**sudo su-**
**whoami**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ew917y42rg9rbu2ajlsi.PNG)

#Command:
**ls**
**cat root.txt**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0i6ph1v464j14py0n535.PNG)

Looks like someone removed the root.txt from this file and its in a USB stick....

Take the time and go into the files and see if there is anything that pops-out at you.

#Command:
**ls -la**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rjr1lodf64o6it36fw21.PNG)

After some searching I come across the **/media** location with a usbstick there.

#Command:
**cd media**
**ls**
**cd usbstick**
**cat damnit.txt**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wgiwanbhmt6cjd1ddzv5.PNG)

It appears that someone else deleted your files off the usb stick. 

#Commnd:
**df -lh**

1. Df = Will report file system disk space usage
2. lh = local and print sizes in powers of 1024
Nice cheat sheet on these commands [Link](https://man7.org/linux/man-pages/man1/df.1.html)

Will show free disk space and lets focus on the **/media/usbstick**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a9rgvgeogl2l6bwc21po.PNG)

You can use **Strings** to look for characters or you could have used **cat** as well.

#Command:
**strings /dev/sdb**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yg19qcsdvbtc5jqsps30.PNG)

Thanks for stopping by!