Mbedbot£ºTLS¼ÓÃܵĺóÃÅ»¯½©Ê¬ÍøÂç
°ä²¼¹¦·ò 2023-09-27GA»Æ½ð¼×Óë¹ãÖÝ´óÑ§Íø°²Ñ§Ôº·¢ÏÖÁËÒ»¸öºóÃÅ»¯µÄÎïÁªÍøDDoS½©Ê¬ÍøÂ磬²¢½«Æä¶¨ÃûΪMbedbot¡£±¾ÎĽ«´ÓÆäÖ´ÐÐÁ÷³Ì¡¢Í¨Ñ¶ºÍ̸¡¢½ÚÔìºÅÁî¼°ºóÃŵȼ¼Êõ·ÖÎö½Ç¶È¶¯ÊÖ£¬¶Ô¸Ã½©Ê¬ÍøÂç½øÐÐÈ«Ãæ½éÉÜ£¬ÒÔ×÷Ϊ¸÷ÐÐÒµ¼°ÓÐ¹ØÆóÒµÔì¶©ÍøÂ簲ȫսÊõµÄ²Î¿¼¡£
2023Äê7Ô³õ£¬GA»Æ½ð¼×Ôڲμӹú¶È³ÁµãÑз¢´òËãÏîÄ¿¡°´ó¹æÄ£Òì¹¹ÎïÁªÍøÍþв¿É¿Ø²¶»ñÓë·ÖÎö¼¼Êõ£¨2022YFB3104100£©¡±µÄ×êÑйý³ÌÖУ¬·¢ÏÖÁËÒ»¸öºóÃÅ»¯µÄÎïÁªÍøDDoS½©Ê¬ÍøÂç¼Ò×å¡£
´úÂë½á¹¹ÉÏ£¬¸Ã½©Ê¬ÍøÂ縴ÓÃÁËMiraiµÄDDoS¹¥»÷ÓйشúÂ룬²¢ÔÚÆä»ù´¡ÉÏÔö³¤https ddosÒÔ¼°tcp syn¹¥»÷ÄÜÁ¦¡£ÓëÆäËü»ùÓÚMiraiÔ´ÂëµÄÖ÷Á÷½©Ê¬ÍøÂç·ÖÆçµÄÊÇ£¬³ýDDoSÖ°ÄÜÖ®±í£¬¸Ã½©Ê¬ÍøÂ绹ʵÏÖÁËÔ¶³ÌÎļþÖÎÀí¡¢¹ý³Ì²Ù×÷µÈÖî¶àºóÃÅÖ°ÄÜ¡£
²¢ÇÒ£¬ÆäʹÓÃtlsºÍ̸ÓëC2½øÐмÓÃÜͨѶ¡£ÒòÆäËùÓÃtlsÀà¿âΪmbedtls£¬ËùÒÔÎÒÃǰѴ˽©Ê¬ÍøÂç¼Ò×嶨ÃûΪMbedbot¡£
¼¼Êõ·ÖÎö
ĿǰΪֹ£¬ÎÒÃÇÁÙʱֻ²¶»ñµ½arm4¼Ü¹¹µÄÑù±¾£¬Î´·¢ÏÔìäËü¼Ü¹¹µÄÑù±¾¡£MbedbotÕûÌå´úÂëºÜ¼ò½à£¬Ã»ÓÐÌ«¶à»¨ÉڵĴ¦Ëù£¬ÊµÏÖ³£¼û²Ù×÷Á÷³Ìºó£¬¼´½øÈëºÍC2µÄ½»»¥Í¨Ñ¶¡£
1¡¢Ö´ÐÐÁ÷³Ì
ÔËÐк󣬴òÓ¡×Ö·û´®"listening tun0"£¬²¢Í¨¹ý¼àÌý31212¶Ë¿Ú£¬ÊµÏÖµ¥Ò»Ê·ýÔËÐС£Ö®ºóͨ¹ýÒì»ò½âÃܳö×Ö·û´®×ÊÔ´£¬ÓëMiraiµÄ×Ö·û´®¸ß¶È³ÁºÏ£º

Ëæºó£¬³õʼ»¯DDoS¹¥»÷ÏòÁ¿£¬¹²Ö§³Ö11¸öDDoS¹¥»÷·½Ê½¡£³õʼ»¯´úÂëÒÔ¼°¸÷¸öDDoS´úÂëÆëÈ«¸´ÓÃ×ÔMirai£º

µ«Mbedbot±ÈMirai¶àÒ»¸öÕë¶ÔhttpsºÍ̸µÄDDoS¹¥»÷ÀàÐÍattack_app_https£¬Í¬ÑùʹÓÃmbedtls¿â£¬ÕâÒ²Êdzõ´Î·¢ÏÖÖ§³ÖhttpsºÍ̸µÄDDoS¹¥»÷¡£

ʵÏÖÉÏÊö²Ù×÷ºó£¬½øÈëºÍC2½»»¥Í¨Ñ¶µÄÑ»·º¯Êý¡£ÔÚ½»»¥º¯ÊýÀÊ×ÏÈͨ¹ýÒì»ò½âÃܳöC2µØÖ·£¬²¢Ê¹ÓÃtlsºÍ̸ºÍC2³ÉÁ¢Í¨Ñ¶¡£tlsÀà¿âΪmbedtls£¬ÆäǰÉíÊÇPolarSLL£¬ÏÖÒѱ»ARM¹«Ë¾ÊÕ¹º£¬ÓÉARM¼¼ÊõÍŶÓÊØ»¤¸üС£

ʹÓÃtls¼ÓÃÜÖ®Ç°ÍøÂçµÄϵͳÐÅÏ¢£¬·¢Ë͸øC2£¬ËæºóÆÚ´ýÖ´ÐÐC2Ï·¢µÄ¸÷ÀàºÅÁî¡£
2¡¢Í¨Ñ¶ºÍ̸
MbedbotµÄͨѶºÍ̸Ïà¶Ôµ¥Ò»¡£ÔÚºÍC2³ÉÁ¢tlsͨѶ֮ºó£¬ÏÈÏòC2·¢ËÍ4×Ö½ÚµÄÉÏÏßÊý¾Ý³¤¶È£¬2×Ö½ÚµÄÊý¾ÝÀàÐÍ"\xFF\xFF"£¬ÔÙ·¢ËÍÊܺ¦ÏµÍ³ÐÅÏ¢£¨ÉÏÏßÊý¾Ý£©¡£

¿É¼û£¬MbedbotÍøÂçµÄϵͳÐÅÏ¢ºÜÈ«Ãæ¡£ÆäÖУº
huuidÊÇÓ²±àÂëµÄ×Ö·û´®£¬ÅúʾC2·þÎñÆ÷£¨host£©Éí·Ýid;
buuidÔòËæ»úÌìÉú£¬°µÊ¾Êܺ¦Ö÷»ú£¨bot£©Éí·Ýid£»
versionÓÃÓÚÅúʾ°æ±¾ÐÅÏ¢¡£
·¢·îÉÏÏßÊý¾ÝÖ®ºó£¬Ö´ÐÐselectº¯Êý£¬³¢ÊÔ½Ó¹ÜC2Ï·¢µÄ¸÷ÀàºÅÁî¡£ÆäÖУ¬Mbedbotÿ15·ÖÖÓ»áÏòC2·¢ËÍÒ»´ÎÓ²±àÂëµÄ¡°ÐÄÌø¡°°ü£¬ÓÃÒÔ¸üÐÂÖ÷»ú´æ»î״̬¡£·¢ËÍÐÄÌø°üÈçÏ£º

ͬʱC2·µ»ØµÄ17×Ö½ÚÐÄÌø°üÊý¾Ý£¬ÈçÏ£º
![]()
ÆäÖÐǰ16×Ö½Ú"\xD9\x01....\x3B\x3F"ÊÇËæ»úÌìÉúµÄSessionID£¬µÚ16×Ö½ÚÊǺÅÁîÂ룬\xFF°µÊ¾ÊÇÐÄÌø°üÊý¾Ý¡£

3¡¢½ÚÔìºÅÁî&ºóÃÅ
MbedbotʵÏÖÁ˺öàºóÃÅÖ°ÄÜ£¬Ô̺¬ÎļþÀà(´´½¨¶ÁÈ¡ÉÏ´«ÏÂÔØÖ´ÐÐ)£¬Ö´ÐÐshell¹ý³Ì£¬DDoS¹¥»÷£¬ÊµÏÖÖ¸¶¨¹ý³Ì£¬³ÁÖÃC2·þÎñÆ÷£¬Í˳ö×ÔÉí¹ý³ÌµÈ¡£

MbedbotµÄºÅÁîÌåʽ±ÈÁ¦µ¥Ò»£¬Ç°16×Ö½ÚÊÇC2Ëæ»úÌìÉúSessionID£¬Í³Ò»Í¨Ñ¶»á»°ÊÇΨһµÄ¡£µÚ16×Ö½ÚÊǺÅÁîÂ룬ÆäºóÊǺÅÁî²ÎÊý¡£

ÒÔÈçϺÅÁîΪÀý£º

FC12¡57D2£¬16×Ö½ÚSessionID£»
0x0F£¬1×Ö½ÚºÅÁîÂ룬´ËºÅÁîÓÃÀ´ÉèÖò¢³ÁÐÂÏνÓеÄC2·þÎñÆ÷¡£
fakembedbotc2.com£¬ºÅÁî²ÎÊý£¬½«C2·þÎñÆ÷³ÁÉèΪ´Ë¡£
Ëæºó£¬Êܺ¦Ö÷»ú³¢ÊÔ½âÎö²¢ÏνÓfakembedbotc2.com£º
![]()
ÒÔÏÂÊǸ÷ºÅÁîÂë¼°Æä¶ÔÓ¦ºóÃÅÖ°ÄÜ£º

½á Óï
MbedbotÆëÈ«¸´ÓÃÁËMiraiµÄDDoS´úÂ룬²¢ÔÚÆä»ù´¡ÉÏÐÂÔöÁ½¸ö¡°×ÔÑÓ×°µÄtcp syn¹¥»÷ÒÔ¼°https ddos¹¥»÷ÄÜÁ¦¡£²¢ÇÒ£¬Õë¶Ô×ÔÉíµÄºóÃÅÖ°ÄܽøÐÐÁË·á˶£¬ÒÔ³¢ÊÔ¼ÓÇ¿¶ÔbotÖ÷»úµÄ½ÚÔìÄÜÁ¦¡£
´Ë±í£¬Ïà½ÏÓÚÆäËü½©Ê¬ÍøÂ磬MbedbotÖ±½ÓʹÓÃtls¼ÓÃܺÍC2µÄͨѶ£¬Ö»¹ÜͨѶºÍ̸×ÔÉí²¢²»¸´ÔÓ£¬µ«ÔÚtls¼Ó³ÖÏ£¬¿ÉÄÜÓÐЧµÄ¶ã±ÜͨÀýÌØµãÖ¸ÎÆ¼ì²â¡£
IOC
66.42.52.39:443
92.38.135.146:77
dftiscasdwe.w8510.com:443


¾©¹«Íø°²±¸11010802024551ºÅ