Mirai

Platform: HackTheBox | Difficulty: Easy | OS: Debian Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Mirai (Debian, attack surface: OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0) (22), Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50) (1982), dnsmasq 2.76 (53), lighttpd 1.4.35 (80)). Foothold via the vulnerable entry point; privilege escalation via default creds. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.48 --min-rate 1000

Enumeration highlights

• Detected OS: Debian.
• Open services: domain (53), http (32400), http (80), ssh (22), upnp (1982), upnp (32469).
• Scan used: nmap -p- -sVC 10.10.10.48 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.48 --min-rate 1000 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-17 22:58 PDT
Warning: 10.10.10.48 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.10.48
Host is up (0.18s latency).
Not shown: 65136 closed tcp ports (conn-refused), 393 filtered tcp ports (no-response)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)
| ssh-hostkey: 
|   1024 aaef5ce08e86978247ff4ae5401890c5 (DSA)
|   2048 e8c19dc543abfe61233bd7e4af9b7418 (RSA)
|   256 b6a07838d0c810948b44b2eaa017422b (ECDSA)
|_  256 4d6840f720c4e552807a4438b8a2a752 (ED25519)
53/tcp    open  domain  dnsmasq 2.76
| dns-nsid: 
|_  bind.version: dnsmasq-2.76
80/tcp    open  http    lighttpd 1.4.35
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: lighttpd/1.4.35
1982/tcp  open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
32400/tcp open  http    Plex Media Server httpd
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
|_http-title: Unauthorized
|_http-favicon: Plex
|_http-cors: HEAD GET POST PUT DELETE OPTIONS
32469/tcp open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 70.83 seconds

1. Based from the nmap result, the machine runs a web application.

2. After ran dirbuster, there's a directory named "admin".

Opens /admin

1. Interesting, based from the results we can conclude that the remote server is running a Raspberry PI machine.

2. Again here, we're making an interpretation where the admin could be using default creds.

3. Checking the internet for Raspberry PI default creds, shall resulting to --> pi:raspberry.

4. Let's try run ssh to the remote server.

We're logged in!!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.