> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/mirai.md).

# Mirai

## Gaining Access

Nmap scan:

![](/files/Zy2gwHjCEDBgKfZORbth)

### SSH Default Credentials

Checking port 80 reveals a Pi-Hole dashboard:

![](/files/n4IIHzG6EYMJo63Tv562)

There's a login function, and I managed to login with default credentials of `pi:raspberry`. I also tried to SSH in as `pi` using these credentials, and it worked for some reason:

![](/files/euKCIK6Ed3LGBxOlV1Mu)

## Privilege Escalation

### Flag Finding

I was able to run `sudo su` on this machine and search for `root.txt`:

![](/files/cXSSICO0ZB6lAXh8rtGy)

Interesting, because the root flag is where on a USB stick. Now, the backup would probably be some file in a different format and compressed. We know that the flag is a string, so we can use `strings` to get it out. It is stored at `/dev/sdb`.

```bash
strings /dev/sdb
```

This would give us the flag once we search the input sufficiently.