Mirai Writeup
Mirai identifies vulnerable IoT devices using a table of more than 60 common factory default usernames and passwords and logs into them to infect them with the Mirai malware
Vulnerability Exploited: Vendor Default Credentials
System Vulnerable: 10.10.10.48
Vulnerability Explanation: It is possible to access the machine using ssh using the default credential of the raspberry pi. Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges.
Vulnerability Fix: Always change the default password of the user and the root with any new installation.
Privilege Escalation Vulnerability: No need for Priv Esc
Vulnerability Fix: The developer should have conformed to the principle of least privilege and the concept of separation of privileges.
Severity: Critical
An initial nmap scan revealed the lighttpd 1.4.35 running on port 80 and ssh on port 22.
Using the default of raspberry pi, the default password and username of ssh are pi:raspberry
Establish an ssh connection using the user pi:
user.txt
Privilege Escalation
Checking the permissions the pi user had:
Run $ sudo su and get the root privilege
Showing the content of root.txt gives that the root flag is on the USB Stick.
To check the attached devised to the system as well as its mount points, you can run the df command as the following:
The USB strick is on /dev/sdb and mounted on /media/usbstick
The file was deleted, we need to get them back:
Using $ cat sdb file on /dev/ directory we can see the previous content of the USB stick:
root.txt
Lessons Learned
To gain an initial foothold on the box we exploited two vulnerabilities.
Use of default credentials. The user used the default password that is shipped with the application. Since default credentials are publicly available and can be easily obtained, the user should have instead used a sufficiently long password that is difficult to crack.
Always separate the privileges from the normal user and the administrators’ users.
Last updated