HackTheBox Mirai - Raspberry Pi Pentesting

Key Takeaways

[Music] hey guys hackersploit here back again with another video in this video we're going to be taking a look at a little bit of an interesting topic and that of course is essentially penetration testing on a raspberry pi right and of course i'm going to be using hack the box to facilitate this because in my opinion the box mirai is probably the best way or you know example that i can use to demonstrate this and why performing enumeration is very very important now the name of this box is you know fairly interesting because it's called mirai now if you're not familiar with um you know cyber security breaches and attacks over the last five to ten years you probably wouldn't know what mira is now in the context of cyber security mirai uh is essentially in reference to a botnet attack called mirai that targeted internet of things devices and the way it did this was of course you know finding out uh ips or enumerating ips um and there's multiple ways you can do this i've explored the process of using shodan i'll probably make a follow-up video that will actually highlight this in the future uh but what happens is uh the the creators of the botnet actually you know found or discovered all of these raspberry pi's on the internet that could be accessed remotely and then of course try to authenticate to them using the default credentials and in some cases it was successful and in some cases it wasn't right so this particular box is based on that on that attack uh to a certain extent and that's why i'm going to be covering it so you can see that i've just spawned it and we'll just copy the ip here and again i'll just paste that in there let's see whether we have anything running in the web server we get a blank page so i've already performed an nmap scan and you can see if i just cut out the contents of the scan here the ip is going to be different because i ran this before the the results of the scanner displayed here and you can take a look at my scan options there by the way i will be making a video that covers the process of utilizing rust scan because a lot of you guys have actually been requesting for that so i'll actually make a video on that but you can see you have um you have ssh running so that's running open sh 6.7 p1 and it's on debian so no ubuntu this time and of course you have port 22. that's standard you also have dns which is probably why let me just close that up is probably why we're getting this blank page here because we have to add this ip to our hosts and add the domain which i'm guessing is going to be mirai dot hack the box and we have a web server we also have a plex media server uh and universal plug-and-play um interface running on port one eight eight four right and um yeah and in addition to that you also have that running on port three two four six nine so there's a lot of ports here and again if you have an idea of what's running on the target you can pretty much you know uh tailor your approach in regards to gaining initial access and i'll show you that right now so the first thing i'm going to do is i'm going to say i'm just going to edit my hosts file here so vim and we'll edit the host file and i'll just add that here so uh let me just add the ip here which i believe i copied and it will say mirai dot hack the box right and write and quit and if we now open that up if i say http uh not https because we don't have port 443 running so mirai dot hack the box if i can type that in there we are so it's going to tell us website is blocked access to the following website has been blocked if you have an ongoing use for the website make sure i please ask the owner of the pie hole in your network all right so there's the first clue so pihole is a um essentially an open source uh piece of software that is used on a raspberry pi to block ads on your network so you plug it in on your network and it acts as sort of like a proxy and essentially blocks all ads on your network for all the devices on your network right and again if we just display the source here we just get a you know basic source in regards to the data that's being output here we also get the version of pi hole right so we we have a pretty good idea of what might be running um in regards to the operating system of this target and the device itself because that's very important so let's perform some directory brute forcing on this particular on this particular web server right so i'm just going to again head over into my terminal here and we'll just minimize that slightly and i'll zoom in here so we'll use go buster right and we'll say directory brute force and i'm just going to say the url is going to be the following right and i then say i can paste in the ip there primarily because go buster will resolve it to its uh domain but we'll actually test and see where that works out so word list will use uh we'll use set lists this time and we'll head over into discovery web content and we'll use the big word list here and i can change the threads to maybe something like 20 to speed it up so i'm just going to hit enter and let's see what we're able to enumerate from go buster so i'm just going to let this complete all right so uh i just received our first result here and that is the admin directory so let's try and see what that brings up here so admin there we are hit enter give that a few seconds it's probably taking uh time because we are running a brute force on this so i'm just going to let that continue all right so the web page has loaded and it looks like it's the pi hole administrator the administrator panel here or rather the interface the web interface for pi hold which essentially allows you to authenticate and provides you with status for your raspberry pi right because that's the typical deployment of this uh of this piece of software and at the bottom you can see you have the buy all version which is 3.1.4 and then the web interface version and the fdl version right and we're not authenticated by default so if i log in it's going to ask us for our password right and again we can try and uh locate the default credentials however we can also you know try and identify whether we have any vulnerabilities for piohol so i'm just going to use i'm just going to perform a search split search so and i've cleared up that there so search split and i'll just paste that in there let me just extend this here so you guys can see what's going on and you can see for piehole versions lower than 4.4 we have an authenticated remote code execution script it's a python script here and i believe that that requires authentication right because it says authenticated remote code execution there that's fairly standard we don't have the password so i'm just going to paste and go here and let's see whether we can identify any information pertaining to this particular exploit and how it works so you can see it's a python script here and it provides you the test the test information and how it works right so it looks like right from the get go you'll need to provide let's see whether yeah we need to provide a password um the local ip and it looks like it provides you with a shell through the use of python now we pretty much uh you know can at this point deduce that the the target system is a raspberry pi and if we take a look at the nmap results here let me just close this out here you can see that it's running ssh so why don't we try and identify some default credentials for the raspberry pi right so i'm going to say search for raspberry pi and default default credentials right and there we are we can see the default raspbian login credentials so those are the operating system user credentials so this pro this will probably work via ssh so the username is pi and the password is raspberry so let's try that out and i'm just going to say right over here ssh pi and we get the ip here i believe i have it copied but i'll copy it again there we are and we hit enter looks like that is working and then we type in the password which again let me just make sure i'm getting it correct here is raspberry we hit enter and we get uh initial access right so that's really the power of um of performing enumeration and having another understanding of what the target is running and how the target is being used in regards to its deployment use case so in this case we can you know pretty much tell that the raspberry pi has been set up on a network to block ads right and from that we can deduce that the operating system that's typically used on a raspberry pi is raspbian and we got the default credentials so that we can log in via ssh and in in we go right so the first thing we are going to need to do is of course enumerate our current privileges you can see right now we're locked in as the user pi right and nothing else provides us you know with any additional information there you can see we're logged in as pi and if i list out the contents of my current working directory or the home directory for the pi user you can see if i let's head over to our desktop we get the user flag so there we are cat user dot txt and we get it there right if we list out the current users on the system we can see that we have the pi um the pi user we also have the pi hall user which is interesting which we can't actually log into that's a service account and we have a root account so uh again no other user accounts that we can detect here just the use of pi as well as the plex media server which is interesting and of course we've not touched upon that but if you have gone through this box that can be uh construed as a rabbit hole if you will because you most likely target the plex server the plex media server all right cool so um if i enumerate the kernel version here you can see linux raspberry pi kernel versions six eight 3.16.0468 p a e right and uh cat at c release this should be running debian in this case it is running debian and debian8 at that all right cool so again if we try and access the roots directory you can see permission denied right but let's try and identify our current privileges and whether we can actually do things that we aren't supposed to do so we can do this using an automated script like line-enum or lin-piece to identify whether we can run certain binaries as as the administrator or as the root user whether we have any new password flag set for any particular scripts or binary similar to the other boxes that we've taken a look at but for example if i run sudo and you know i just say sudo l you can see that this will display out the the current permissions for this user right so the user pi can actually run all commands without providing a password so they can this user can run all system commands including the commands limited to administrators and can run them without providing a password or providing the root password so again if we what we can do is we can actually say sudo password and change the password for the root user and i'll just specify a new password for the root user and let me just make sure i'm typing that correctly there we are password are updated successfully so if i say switch user if i want to switch my user into the root user i provide the password that i just created or set up and we have root access there we are we're currently the root user so let's head over into the root uh directory and if we list the contents in here we have the root flag let's cut that out oh looks like we have an interesting message here so it says i lost my original root.txt i think i may have a backup on my usb stick alright so that's all that also ties into the use case off a raspberry pi in that we saw that the target was also running a plex media server and you can of course have your videos movies and multimedia data stored in another location on your network but you what you can do is also attach a usb stick or a usb hard drive an external hard drive to your raspberry pi and then you set up likes to share the videos uh or serve the videos on the hard drive through plex right right so we can list out the current um devices or the attached storage devices on the target by using um lsblk and saying grep sds or storage devices in this case you can see you have sda right which is your main disk it's only 10 gigs and then you have sda1 these are the two partitions and you have sdb which again is the name is usb stick so if we head over to cd uh if i say cd media usb stick and i'll list out the contents there you can see we have dammit.txt so let me cut that out it's going to tell you damn it sorry man i accidentally deleted your files off the usb stick do you know if there is any way to get them back and that's by james our kind of james well if we take a close look at the directories within the usb stick we have a lost and found directory which is uh sort of an acronym or rather another word or rather two words for the recycle um for the recycle bin so if we head over into lost and found uh that doesn't display anything right so what if we try and list out the strings within this particular directory so we can say uh strings and dev sdb because that's the storage device b we hit enter and it looks like we get the flag here right and of course that's different from the user flag that we cut it out earlier let me just compare that yes it is different and we get both the flags right and yep that's pretty much it so this was a very interesting box one that i really enjoyed when i did it uh initially because it wasn't structured in the traditional sense and you know it wasn't it has a few ctf like um you know configurations like for example uh the flags here uh but the initial access uh you know vector was uh really really uh accurate in the sense that you know raspberry pi's that people buy and set up out there for whatever reason in most cases will have default credentials and you know gaining access in this case we were able to elevate our privileges because our user could run any command which is not really accurate but we we could have found another way of actually elevating our privileges irregardless of whether the user we logged in at uh had any special privileges in regards to the commands or binaries that they could execute however in this case it was fairly straightforward as i said the initial the initial section that involved enumeration for this box uh you know could send you down various rabbit holes like for example the plex media server which has a few vulnerabilities but i wasn't successful in gaining access that way i did or i was able to use the remote code authentication python script once i gained access to the target system and checked out the configuration file for the default for the credentials to log into the pi hole web interface and then i used that with the authenticated cookie and i was able to get remote code you know authenticated rce on the target system but of course that's after the fact um that being said that's going to be it for this video let me know what you guys think if you have any other content ideas or suggestions leave them in the comment section if you want to reach me personally you can you can contact me via twitter or via our discord server the link is in the description section we have fantastic discussions regarding you know various topics pertaining to penetration testing red teaming blue teaming malware analysis reverse engineering etc etc and yeah feel free to join in and we always welcome to have you there and i'm always available to answer your questions that being said that's going to be it for this video and i'll be seeing you in the next video a huge thank you to all of our patreons uh your support is greatly appreciated and this is a formal thank you so thank you shamir douglas ryan carr sandor michael busby sits up doozy defean bari dustin umpres and michael hubbard your support is greatly appreciated and you keep us making even more high quality content for you guys so thank you [Music] you