root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat mirai.md
// writeups

Mirai

1 Sep 2017 · 8 min read
writeupshacktheboxlinuxEasyretiredvip
Mirai - maquina de Hack The Box

Executive summary — Mirai is a themed Easy Linux box: the name evokes the Mirai botnet (2016), which infected hundreds of thousands of IoT devices by scanning the Internet for unchanged factory credentials. The target here is exactly that scenario in miniature: a Raspberry Pi running Pi-hole, reachable over SSH with pi:raspberry, where pi has unrestricted sudo → instant root. The real challenge comes after: the root flag isn't where it should be — you need basic forensics on a USB stick to recover a «deleted» file (spoiler: deleting on Linux doesn't destroy the data).

PlatformHack The Box
Operating systemLinux
DifficultyEasy
StatusRetired
Target IP10.129.X.X

Attack map

[22/53/80] Raspberry Pi + Pi-hole
   │  default Raspberry Pi credentials (pi:raspberry) over SSH
   ▼
[SSH]  pi  (user.txt)
   │  sudo -l → (ALL) NOPASSWD: ALL  →  sudo su
   ▼
[ROOT]  but root.txt isn't in /root — it was «deleted» from a USB stick
   │  lsblk → /dev/sdb (/media/usbstick)
   ▼
[FORENSICS]  strings /dev/sdb | grep HTB (deleting ≠ wiping)
   ▼
[ROOT.TXT recovered]

1. Reconnaissance

As always, we start with a full port and version scan:

nmap -sC -sV -p- 10.129.X.X
22/tcp  open  ssh     OpenSSH
53/tcp  open  domain  dnsmasq (Pi-hole)
80/tcp  open  http    lighttpd — Pi-hole admin panel

Key clue: port 53 running dnsmasq plus a web panel on 80 that turns out to be Pi-hole (the DNS ad-blocker commonly installed on a home Raspberry Pi) is the device's fingerprint. And a hobbyist Raspberry Pi screams one word: default credentials.

2. Initial access — default credentials

Raspberry Pi OS (formerly «Raspbian») ships out of the box with the user pi and password raspberry. For years this pair came pre-configured without forcing a change on first boot, so countless hobbyist and home devices ended up exposed with it intact. We try it directly over SSH:

ssh pi@10.129.X.X
# password: raspberry
whoami
→ pi

Mirai's lesson, literally: the original malware didn't exploit any software flaw — it simply tried a list of ~60 default username:password pairs (routers, IP cameras, DVRs...) against any IP with Telnet open. Here we replicate the exact same pattern over SSH against a single, well-known credential pair.

3. Post-exploitation as pi

Once in, we confirm the user and locate the home directory before going for the flag:

id
ls
cd Desktop
ls
cat user.txt

The user flag sits in ~/Desktop/user.txt, with no extra enumeration required: the foothold and the user flag are the same move, courtesy of the default credentials.

4. Escalation to root

First thing on any Linux box: check the current user's sudo privileges.

sudo -l
User pi may run the following commands on raspberrypi:
    (ALL) NOPASSWD: ALL

NOPASSWD: ALL means pi can run any command as root without being prompted for a password. Many hobbyist-oriented Raspberry Pi images ship this way for convenience (avoiding constant sudo prompts on a single-user device) — but combined with unchanged factory credentials, it's a perfect storm: anyone who guesses pi:raspberry is root in a single hop.

Exploitation is trivial:

sudo su
whoami
→ root

5. The twist: root without a root flag

We're root, but going for the expected flag it isn't where it should be:

cd /root
ls

There's no lab bug here — this is the box's second, deliberate challenge. The flag isn't in a typical location; we need to enumerate beyond the usual /root.

6. USB discovery

We check for extra mount points, common on devices with external storage (a Raspberry Pi running Pi-hole often has a USB stick attached, e.g. for log storage or extra disk space):

ls /media
usbstick
cd /media/usbstick
ls
damnit.txt

The file name alone hints something went wrong. We read it:

cat damnit.txt
"I accidentally deleted your files off the USB stick"

7. Forensics: deleting isn't wiping

Key concept: on Linux-style filesystems (ext4, FAT...), deleting a file doesn't erase its data from disk. All that happens is the directory entry gets removed (the name and the pointer to the data blocks), and that space is marked «free for reuse». As long as nothing new overwrites those physical blocks, the original content is still there, byte for byte, and can be read by going straight to the raw device instead of through the filesystem.

First we identify which block device the USB stick maps to:

lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda      8:0    0   20G  0 disk
└─sda1   8:1    0   20G  0 part /
sdb      8:16   1   ...  0 disk /media/usbstick

8. Recovering the root flag

With /dev/sdb identified, we dump its raw content looking for readable text: strings scans the block device block by block, bypassing the filesystem and its «deletion» metadata entirely, so it finds any plaintext still physically present on disk, «deleted» or not.

strings /dev/sdb | grep HTB

Among the remnants of «deleted» data the root flag shows up, in the usual HTB format. Box solved. 🏴‍☠️

Key concept (recap): «the filesystem hides, the disk doesn't». A normal delete is a logical operation on metadata; to actually destroy data you need to physically overwrite the disk (shred, wipe, or encrypt the volume from the start).

Vulnerability summary

PhaseComponentVulnerabilityImpact
ReconPorts 53/80Pi-hole/dnsmasq fingerprint → identifies a Raspberry PiGuides the default-credential guess
FootholdSSH · Raspberry PiUnchanged factory credentials (pi:raspberry)Access as pi + user flag
PrivEscsudopi with NOPASSWD: ALL (factory convenience config)Instant root
RecoveryUSB / /dev/sdb«Deleted» data is recoverable (deleting ≠ wiping at the filesystem level)Root flag recovered via forensics

Lessons learned

  • ALWAYS change default credentials on any device (pi:raspberry is the textbook example): that's literally how the Mirai botnet was built at global scale.
  • IoT and «casual» devices are a critical attack surface: one forgotten Raspberry Pi with factory credentials can be the entry point into an entire home or corporate network.
  • Convenience ≠ security: a NOPASSWD: ALL meant to avoid annoying a personal device's single user becomes a trivial privilege escalation the moment someone else gets that account.
  • Deleting isn't wiping: to actually destroy data you must overwrite it (shred), or better, encrypt the disk from first use so «deleted» data is useless without the key.
  • Basic forensics with strings against the raw device is a surprisingly powerful and simple data-recovery technique — useful both offensively and for incident investigation.