Mirai
Personal Rating: Easy
Enumeration
sudo nmap -sV -sC -p- <IP>
The site at port 80 is empty.
dix axfr 10.10.10.48 @10.10.10.48 did not work.
Running a webbrute: feroxbuster -u http://10.10.10.48:32400/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -S 101
/identity was found;
Well, it did not work. I installed upnpc to try to interact with the upnp server. For port 1615 this did not work either. Investigating the response when accessing Port 80, we see an interesting header:
Running a dirbrute on Port 80:
/versions with info ,v3.1.4,v3.1,v2.10 This can also be seen on the admin interface:
Pi-hole Version v3.1.4 Web Interface Version v3.1 FTL Version v2.10
According to searchsploit there are authenticated RCEs for this version of pi-hole
Default Credentials
Since we have ssh access, lets try pi:raspberry to authenticate to the website.
Since we know that it is a PiHole, I tried pi:raspberry which also worked for ssh login. sudo su worked to get root access.
USB Drive Data Recovery
root@raspberrypi:/home/pi/Desktop# cat /root/root.txt
I lost my original root.txt! I think I may have a backup on my USB stick...
root@raspberrypi:/home/pi/Desktop# cat /etc/fstab
root@raspberrypi:/media/usbstick# cat damnit.txt
The .local/share/Trash of “pi” was empty
I ran fsck on the drive, but that did not return the file.
I checked the guided mode and got the tip I needed: You can run “strings /dev/sdb” to read the flag since it is still present in the memory of the stick. It is just not accessible by the filesystem regularly anymore.
Last updated
