+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Remote Administration & Stress Testing (https://sinister.ly/Forum-Remote-Administration-Stress-Testing)
+--- Thread: [Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? (/Thread-Q-How-is-Mirai-able-to-install-tools-on-IOT-devices-if-busybox-has-no-compilers)
[Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? - Blink - 11-27-2016
I was doing some research to write a telnet scanner for an IRC net, but then I thought:
How are IOT-botnets like Mirai able to install their own tools on busybox-based IOT devices if busybox doesn't include any compilers?
(it also doesn't include any interpreted languages besides for ash)
Unless i'm mistaken, I'm pretty sure that it'll come across a different type of processor every now and then (probably most often ARM or MIPS).
Do IOT devices usually include gcc? (Even then, why would they?)
Thanks
RE: [Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? - Pikami - 11-27-2016
(11-27-2016, 07:20 PM)Ender Wrote: I was doing some research to write a telnet scanner for an IRC net, but then I thought:
How are IOT-botnets like Mirai able to install their own tools on busybox-based IOT devices if busybox doesn't include any compilers?
(it also doesn't include any interpreted languages besides for ash)
Unless i'm mistaken, I'm pretty sure that it'll come across a different type of processor every now and then (probably most often ARM or MIPS).
Do IOT devices usually include gcc? (Even then, why would they?)
Thanks
Mirai is cross compiled on one PC.
Here's the build script:
Spoiler:
#!/bin/bash
FLAGS=""
function compile_bot {
"$1-gcc" -std=c99 $3 bot/*.c -O3 -fomit-frame-pointer -fdata-sections -ffunction-sections -Wl,--gc-sections -o release/"$2" -DMIRAI_BOT_ARCH=\""$1"\"
"$1-strip" release/"$2" -S --strip-unneeded --remove-section=.note.gnu.gold-version --remove-section=.comment --remove-section=.note --remove-section=.note.gnu.build-id --remove-section=.note.ABI-tag --remove-section=.jcr --remove-section=.got.plt --remove-section=.eh_frame --remove-section=.eh_frame_ptr --remove-section=.eh_frame_hdr
}
if [ $# == 2 ]; then
if [ "$2" == "telnet" ]; then
FLAGS="-DMIRAI_TELNET"
elif [ "$2" == "ssh" ]; then
FLAGS="-DMIRAI_SSH"
fi
else
echo "Missing build type."
echo "Usage: $0 <debug | release> <telnet | ssh>"
fi
if [ $# == 0 ]; then
echo "Usage: $0 <debug | release> <telnet | ssh>"
elif [ "$1" == "release" ]; then
rm release/mirai.*
rm release/miraint.*
go build -o release/cnc cnc/*.go
compile_bot i586 mirai.x86 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot mips mirai.mips "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot mipsel mirai.mpsl "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot armv4l mirai.arm "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot armv5l mirai.arm5n "$FLAGS -DKILLER_REBIND_SSH"
compile_bot armv6l mirai.arm7 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot powerpc mirai.ppc "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot sparc mirai.spc "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot m68k mirai.m68k "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot sh4 mirai.sh4 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot i586 miraint.x86 "-static"
compile_bot mips miraint.mips "-static"
compile_bot mipsel miraint.mpsl "-static"
compile_bot armv4l miraint.arm "-static"
compile_bot armv5l miraint.arm5n " "
compile_bot armv6l miraint.arm7 "-static"
compile_bot powerpc miraint.ppc "-static"
compile_bot sparc miraint.spc "-static"
compile_bot m68k miraint.m68k "-static"
compile_bot sh4 miraint.sh4 "-static"
go build -o release/scanListen tools/scanListen.go
elif [ "$1" == "debug" ]; then
gcc -std=c99 bot/*.c -DDEBUG "$FLAGS" -static -g -o debug/mirai.dbg
mips-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.mips
armv4l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm
armv6l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm7
sh4-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.sh4
gcc -std=c99 tools/enc.c -g -o debug/enc
gcc -std=c99 tools/nogdb.c -g -o debug/nogdb
gcc -std=c99 tools/badbot.c -g -o debug/badbot
go build -o debug/cnc cnc/*.go
go build -o debug/scanListen tools/scanListen.go
else
echo "Unknown parameter $1: $0 <debug | release>"
fi
FLAGS=""
function compile_bot {
"$1-gcc" -std=c99 $3 bot/*.c -O3 -fomit-frame-pointer -fdata-sections -ffunction-sections -Wl,--gc-sections -o release/"$2" -DMIRAI_BOT_ARCH=\""$1"\"
"$1-strip" release/"$2" -S --strip-unneeded --remove-section=.note.gnu.gold-version --remove-section=.comment --remove-section=.note --remove-section=.note.gnu.build-id --remove-section=.note.ABI-tag --remove-section=.jcr --remove-section=.got.plt --remove-section=.eh_frame --remove-section=.eh_frame_ptr --remove-section=.eh_frame_hdr
}
if [ $# == 2 ]; then
if [ "$2" == "telnet" ]; then
FLAGS="-DMIRAI_TELNET"
elif [ "$2" == "ssh" ]; then
FLAGS="-DMIRAI_SSH"
fi
else
echo "Missing build type."
echo "Usage: $0 <debug | release> <telnet | ssh>"
fi
if [ $# == 0 ]; then
echo "Usage: $0 <debug | release> <telnet | ssh>"
elif [ "$1" == "release" ]; then
rm release/mirai.*
rm release/miraint.*
go build -o release/cnc cnc/*.go
compile_bot i586 mirai.x86 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot mips mirai.mips "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot mipsel mirai.mpsl "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot armv4l mirai.arm "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot armv5l mirai.arm5n "$FLAGS -DKILLER_REBIND_SSH"
compile_bot armv6l mirai.arm7 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot powerpc mirai.ppc "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot sparc mirai.spc "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot m68k mirai.m68k "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot sh4 mirai.sh4 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot i586 miraint.x86 "-static"
compile_bot mips miraint.mips "-static"
compile_bot mipsel miraint.mpsl "-static"
compile_bot armv4l miraint.arm "-static"
compile_bot armv5l miraint.arm5n " "
compile_bot armv6l miraint.arm7 "-static"
compile_bot powerpc miraint.ppc "-static"
compile_bot sparc miraint.spc "-static"
compile_bot m68k miraint.m68k "-static"
compile_bot sh4 miraint.sh4 "-static"
go build -o release/scanListen tools/scanListen.go
elif [ "$1" == "debug" ]; then
gcc -std=c99 bot/*.c -DDEBUG "$FLAGS" -static -g -o debug/mirai.dbg
mips-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.mips
armv4l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm
armv6l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm7
sh4-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.sh4
gcc -std=c99 tools/enc.c -g -o debug/enc
gcc -std=c99 tools/nogdb.c -g -o debug/nogdb
gcc -std=c99 tools/badbot.c -g -o debug/badbot
go build -o debug/cnc cnc/*.go
go build -o debug/scanListen tools/scanListen.go
else
echo "Unknown parameter $1: $0 <debug | release>"
fi
If you look closely you can see that it builds a binary file for every architecture
RE: [Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? - Blink - 11-28-2016
(11-27-2016, 08:47 PM)Pikami Wrote:(11-27-2016, 07:20 PM)Ender Wrote: I was doing some research to write a telnet scanner for an IRC net, but then I thought:
How are IOT-botnets like Mirai able to install their own tools on busybox-based IOT devices if busybox doesn't include any compilers?
(it also doesn't include any interpreted languages besides for ash)
Unless i'm mistaken, I'm pretty sure that it'll come across a different type of processor every now and then (probably most often ARM or MIPS).
Do IOT devices usually include gcc? (Even then, why would they?)
Thanks
Mirai is cross compiled on one PC.
Here's the build script:
Spoiler:
#!/bin/bash
FLAGS=""
function compile_bot {
"$1-gcc" -std=c99 $3 bot/*.c -O3 -fomit-frame-pointer -fdata-sections -ffunction-sections -Wl,--gc-sections -o release/"$2" -DMIRAI_BOT_ARCH=\""$1"\"
"$1-strip" release/"$2" -S --strip-unneeded --remove-section=.note.gnu.gold-version --remove-section=.comment --remove-section=.note --remove-section=.note.gnu.build-id --remove-section=.note.ABI-tag --remove-section=.jcr --remove-section=.got.plt --remove-section=.eh_frame --remove-section=.eh_frame_ptr --remove-section=.eh_frame_hdr
}
if [ $# == 2 ]; then
if [ "$2" == "telnet" ]; then
FLAGS="-DMIRAI_TELNET"
elif [ "$2" == "ssh" ]; then
FLAGS="-DMIRAI_SSH"
fi
else
echo "Missing build type."
echo "Usage: $0 <debug | release> <telnet | ssh>"
fi
if [ $# == 0 ]; then
echo "Usage: $0 <debug | release> <telnet | ssh>"
elif [ "$1" == "release" ]; then
rm release/mirai.*
rm release/miraint.*
go build -o release/cnc cnc/*.go
compile_bot i586 mirai.x86 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot mips mirai.mips "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot mipsel mirai.mpsl "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot armv4l mirai.arm "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot armv5l mirai.arm5n "$FLAGS -DKILLER_REBIND_SSH"
compile_bot armv6l mirai.arm7 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot powerpc mirai.ppc "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot sparc mirai.spc "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot m68k mirai.m68k "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot sh4 mirai.sh4 "$FLAGS -DKILLER_REBIND_SSH -static"
compile_bot i586 miraint.x86 "-static"
compile_bot mips miraint.mips "-static"
compile_bot mipsel miraint.mpsl "-static"
compile_bot armv4l miraint.arm "-static"
compile_bot armv5l miraint.arm5n " "
compile_bot armv6l miraint.arm7 "-static"
compile_bot powerpc miraint.ppc "-static"
compile_bot sparc miraint.spc "-static"
compile_bot m68k miraint.m68k "-static"
compile_bot sh4 miraint.sh4 "-static"
go build -o release/scanListen tools/scanListen.go
elif [ "$1" == "debug" ]; then
gcc -std=c99 bot/*.c -DDEBUG "$FLAGS" -static -g -o debug/mirai.dbg
mips-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.mips
armv4l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm
armv6l-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.arm7
sh4-gcc -std=c99 -DDEBUG bot/*.c "$FLAGS" -static -g -o debug/mirai.sh4
gcc -std=c99 tools/enc.c -g -o debug/enc
gcc -std=c99 tools/nogdb.c -g -o debug/nogdb
gcc -std=c99 tools/badbot.c -g -o debug/badbot
go build -o debug/cnc cnc/*.go
go build -o debug/scanListen tools/scanListen.go
else
echo "Unknown parameter $1: $0 <debug | release>"
fi
If you look closely you can see that it builds a binary file for every architecture
Thanks, that's a lot of architectures
RE: [Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? - DarkMuse - 11-28-2016
oneLineResponse@kali:~# searchsploit IOT
RE: [Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? - Blink - 12-11-2016
(11-28-2016, 04:43 PM)DarkMuse Wrote: oneLineResponse@kali:~# searchsploit IOTAm I missing something here?
Code:
----------------------------------------- --------------------------------------
Exploit Title | Path
| (/usr/share/exploitdb-git/platforms)
----------------------------------------- --------------------------------------
Audiotran 1.4.1 (Windows XP SP2/SP3 Engl | /windows/local/11079.rb
Audiotran 1.4.1 - '.pls' Stack Overflow | /windows/local/11109.rb
Audiotran 1.4.1 - Direct RET Buffer Over | /windows/local/11171.pl
Audiotran 1.4.2.4 - SEH Overflow" | /win_x86/local/14961.py
Audiotran 1.4.2.4 - SEH Overflow (DEP By | /windows/local/15047.rb
AudioTran 1.4.2.4 - SafeSEH + SEHOP Expl | /windows/local/15184.c
Audiotran 1.4.1 - '.pls' Stack Buffer Ov | /windows/local/16626.rb
ISC BIND 4.9.7 -T1B - named SIGINT and S | /linux/local/19072.txt
Audiotran - '.pls' Stack Buffer Overflow | /windows/local/31766.rb
Riot Games League of Legends - Insecure | /windows/local/39916.txt
Oracle BeeHive 2 - voice-servlet prepare | /windows/remote/38860.rb
RiotPix 0.61 - (forumid) Blind SQL Injec | /php/webapps/7679.php
RiotPix 0.61 - (Authentication Bypass) S | /php/webapps/7682.txt
Joomla! Component 'com_biblioteca' 1.0 B | /php/webapps/14703.txt
----------------------------------------- --------------------------------------RE: [Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? - DarkMuse - 12-11-2016
(12-11-2016, 06:43 AM)Ender Wrote:(11-28-2016, 04:43 PM)DarkMuse Wrote: oneLineResponse@kali:~# searchsploit IOTAm I missing something here?
Code:----------------------------------------- -------------------------------------- Exploit Title | Path | (/usr/share/exploitdb-git/platforms) ----------------------------------------- -------------------------------------- Audiotran 1.4.1 (Windows XP SP2/SP3 Engl | /windows/local/11079.rb Audiotran 1.4.1 - '.pls' Stack Overflow | /windows/local/11109.rb Audiotran 1.4.1 - Direct RET Buffer Over | /windows/local/11171.pl Audiotran 1.4.2.4 - SEH Overflow" | /win_x86/local/14961.py Audiotran 1.4.2.4 - SEH Overflow (DEP By | /windows/local/15047.rb AudioTran 1.4.2.4 - SafeSEH + SEHOP Expl | /windows/local/15184.c Audiotran 1.4.1 - '.pls' Stack Buffer Ov | /windows/local/16626.rb ISC BIND 4.9.7 -T1B - named SIGINT and S | /linux/local/19072.txt Audiotran - '.pls' Stack Buffer Overflow | /windows/local/31766.rb Riot Games League of Legends - Insecure | /windows/local/39916.txt Oracle BeeHive 2 - voice-servlet prepare | /windows/remote/38860.rb RiotPix 0.61 - (forumid) Blind SQL Injec | /php/webapps/7679.php RiotPix 0.61 - (Authentication Bypass) S | /php/webapps/7682.txt Joomla! Component 'com_biblioteca' 1.0 B | /php/webapps/14703.txt ----------------------------------------- --------------------------------------
Yeah there were more specific things. Try maybe Internet Of Things or Samsung and look through there. Try different keywords.
RE: [Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? - Blink - 12-11-2016
(12-11-2016, 07:02 AM)DarkMuse Wrote:Samsung worked.(12-11-2016, 06:43 AM)Ender Wrote:(11-28-2016, 04:43 PM)DarkMuse Wrote: oneLineResponse@kali:~# searchsploit IOTAm I missing something here?
Code:----------------------------------------- -------------------------------------- Exploit Title | Path | (/usr/share/exploitdb-git/platforms) ----------------------------------------- -------------------------------------- Audiotran 1.4.1 (Windows XP SP2/SP3 Engl | /windows/local/11079.rb Audiotran 1.4.1 - '.pls' Stack Overflow | /windows/local/11109.rb Audiotran 1.4.1 - Direct RET Buffer Over | /windows/local/11171.pl Audiotran 1.4.2.4 - SEH Overflow" | /win_x86/local/14961.py Audiotran 1.4.2.4 - SEH Overflow (DEP By | /windows/local/15047.rb AudioTran 1.4.2.4 - SafeSEH + SEHOP Expl | /windows/local/15184.c Audiotran 1.4.1 - '.pls' Stack Buffer Ov | /windows/local/16626.rb ISC BIND 4.9.7 -T1B - named SIGINT and S | /linux/local/19072.txt Audiotran - '.pls' Stack Buffer Overflow | /windows/local/31766.rb Riot Games League of Legends - Insecure | /windows/local/39916.txt Oracle BeeHive 2 - voice-servlet prepare | /windows/remote/38860.rb RiotPix 0.61 - (forumid) Blind SQL Injec | /php/webapps/7679.php RiotPix 0.61 - (Authentication Bypass) S | /php/webapps/7682.txt Joomla! Component 'com_biblioteca' 1.0 B | /php/webapps/14703.txt ----------------------------------------- --------------------------------------
Yeah there were more specific things. Try maybe Internet Of Things or Samsung and look through there. Try different keywords.
I love your one-line responses, it's amusing.
RE: [Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? - DarkMuse - 12-11-2016
(12-11-2016, 07:04 AM)Ender Wrote:(12-11-2016, 07:02 AM)DarkMuse Wrote:Samsung worked.(12-11-2016, 06:43 AM)Ender Wrote: Am I missing something here?
Code:----------------------------------------- -------------------------------------- Exploit Title | Path | (/usr/share/exploitdb-git/platforms) ----------------------------------------- -------------------------------------- Audiotran 1.4.1 (Windows XP SP2/SP3 Engl | /windows/local/11079.rb Audiotran 1.4.1 - '.pls' Stack Overflow | /windows/local/11109.rb Audiotran 1.4.1 - Direct RET Buffer Over | /windows/local/11171.pl Audiotran 1.4.2.4 - SEH Overflow" | /win_x86/local/14961.py Audiotran 1.4.2.4 - SEH Overflow (DEP By | /windows/local/15047.rb AudioTran 1.4.2.4 - SafeSEH + SEHOP Expl | /windows/local/15184.c Audiotran 1.4.1 - '.pls' Stack Buffer Ov | /windows/local/16626.rb ISC BIND 4.9.7 -T1B - named SIGINT and S | /linux/local/19072.txt Audiotran - '.pls' Stack Buffer Overflow | /windows/local/31766.rb Riot Games League of Legends - Insecure | /windows/local/39916.txt Oracle BeeHive 2 - voice-servlet prepare | /windows/remote/38860.rb RiotPix 0.61 - (forumid) Blind SQL Injec | /php/webapps/7679.php RiotPix 0.61 - (Authentication Bypass) S | /php/webapps/7682.txt Joomla! Component 'com_biblioteca' 1.0 B | /php/webapps/14703.txt ----------------------------------------- --------------------------------------
Yeah there were more specific things. Try maybe Internet Of Things or Samsung and look through there. Try different keywords.
I love your one-line responses, it's amusing.
Its a useful skill, being able to find humor in simplicity
RE: [Q] How is Mirai able to install tools on IOT devices if busybox has no compilers? - Kyzer - 12-14-2016
As discussed it drops multiple payloads depending on the modem. Thankfully though, it is only resident memory now, but I heard a rumor there is a newer IOT botnet that has begun re-flashing firmwares already. This is a new disaster waiting to happen.