> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/mirai.md).

# Mirai

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f1af9461a3fcdcb66fa269e9b5b5ead6aeb089c0%2Fimage.png?alt=media)

### SSH Default Credentials

Checking port 80 reveals a Pi-Hole dashboard:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1932f2aebb0b753de0c908a1aed8432547fc5748%2Fimage.png?alt=media)

There's a login function, and I managed to login with default credentials of `pi:raspberry`. I also tried to SSH in as `pi` using these credentials, and it worked for some reason:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cc45ecaf72e9d2976e324852e1e4d59d46538da9%2Fimage.png?alt=media)

## Privilege Escalation

### Flag Finding

I was able to run `sudo su` on this machine and search for `root.txt`:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ea82c78729f822d6bcd1843b133359d053e7ada3%2Fimage.png?alt=media)

Interesting, because the root flag is where on a USB stick. Now, the backup would probably be some file in a different format and compressed. We know that the flag is a string, so we can use `strings` to get it out. It is stored at `/dev/sdb`.

```bash
strings /dev/sdb
```

This would give us the flag once we search the input sufficiently.