{"id":58459,"date":"2019-01-01T09:00:24","date_gmt":"2019-01-01T01:00:24","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=58459"},"modified":"2018-12-31T15:59:22","modified_gmt":"2018-12-31T07:59:22","slug":"mirai-%e8%ae%8a%e7%a8%ae-miori-%e5%86%8d%e9%80%b2%e5%8c%96%ef%bc%9aiot%e6%ae%ad%e5%b1%8d%e7%b6%b2%e8%b7%af%e9%80%8f%e9%81%8ethinkphp%e9%81%a0%e7%ab%af%e7%a8%8b%e5%bc%8f%e7%a2%bc%e5%9f%b7%e8%a1%8c","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=58459","title":{"rendered":"Mirai \u8b8a\u7a2e Miori \u518d\u9032\u5316\uff1aIoT\u6bad\u5c4d\u7db2\u8def\u900f\u904eThinkPHP\u9060\u7aef\u7a0b\u5f0f\u78bc\u57f7\u884c\u6f0f\u6d1e\u6563\u64ad"},"content":{"rendered":"

\u5c0d\u8a31\u591a\u7684\u7269\u806f\u7db2\uff08IoT ,Internet of Thing<\/a>\uff09<\/a>\u4f7f\u7528\u8005\u4f86\u8aaa\uff0c\u91dd\u5c0d\u667a\u6167\u578b\u8a2d\u5099\u7684\u6f0f\u6d1e\u653b\u64ca\u4e00\u76f4\u90fd\u662f\u500b\u554f\u984c\u3002\u800c\u6700\u60e1\u540d\u662d\u5f70\u7684\u7269\u806f\u7db2\u5a01\u8105\u6216\u8a31\u662f\u4e0d\u65b7\u8b8a\u7a2e\u7684Mirai<\/a>\u60e1\u610f\u8edf\u9ad4\uff0c\u4e00\u76f4\u88ab\u7528\u5728\u8a31\u591a\u7684\u653b\u64ca\u6d3b\u52d5\u4e2d\uff0c\u6703\u5229\u7528\u9810\u8a2d\u6216\u5f31\u5e33\u5bc6\u4f86\u5165\u4fb5\u8a2d\u5099\u3002\u81ea\u5f9e\u5b83\u7684\u539f\u59cb\u78bc\u57282016\u5e74\u6d41\u51fa\u4e4b\u5f8c\uff0c\u51fa\u73fe<\/a>\u4e86\u5404\u7a2e\u4e0d\u540c\u7684Mirai\u8b8a\u7a2e\u548c\u884d\u751f\u75c5\u6bd2\u3002<\/p>\n

<\/p>\n

\u6211\u5011\u5206\u6790\u4e86\u4e00\u500b\u7a31\u70ba\u300cMiori\u300d\u7684Mirai\u8b8a\u7a2e\uff0c\u5b83\u6703\u900f\u904ePHP\u6846\u67b6\uff08ThinkPHP\uff09\u7684\u9060\u7aef\u7a0b\u5f0f\u78bc\u57f7\u884c\uff08RCE\uff09\u6f0f\u6d1e\u6563\u64ad\u3002\u5b83\u6240\u5229\u7528\u7684\u6f0f\u6d1e\u6bd4\u8f03\u65b0 \u2013 \u76f8\u95dc\u7684\u8a73\u7d30\u8cc7\u8a0a\u523012\u670811\u65e5\u624d\u6d6e\u51fa\u6c34\u9762<\/a>\u3002\u9019\u96bbIoT\u6bad\u5c4d\u7db2\u8def\u75c5\u6bd2\u6703\u653b\u64caThinkPHP 5.0.23\u53ca5.1.31\u4e4b\u524d\u7248\u672c\u7684\u4e0a\u8ff0\u6f0f\u6d1e\u4f86\u9032\u884c\u6563\u64ad\u3002\u76f4\u5f97\u6ce8\u610f\u7684\u662f\uff0c\u6211\u5011\u7684Smart Protection Network\u4e5f\u986f\u793a\u51faThinkPHP RCE\u76f8\u95dc\u8cc7\u5b89\u4e8b\u4ef6\u5728\u6700\u8fd1\u6709\u6240\u589e\u52a0\u3002\u6211\u5011\u8a8d\u70ba\u99ed\u5ba2\u5011\u6703\u5404\u81ea\u5229\u7528ThinkPHP\u6f0f\u6d1e\u4f86\u8cfa\u53d6\u597d\u8655\u3002<\/p>\n

\u9664\u4e86Miori\uff0c\u6709\u5e7e\u96bb\u5df2\u77e5Mirai\u8b8a\u7a2e\uff08\u5982IZ1H9\u548cAPEP\uff09\u4e5f\u6703\u5229\u7528\u76f8\u540c\u7684RCE\u6f0f\u6d1e\u9032\u884c\u6563\u64ad\u3002\u9019\u4e9b\u8b8a\u7a2e\u90fd\u6703\u7528\u9810\u8a2d\u5e33\u5bc6\u6216\u66b4\u529b\u7834\u89e3\u653b\u64ca\u4f86\u900f\u904eTelnet\u5165\u4fb5\u4e26\u6563\u64ad\u5230\u5176\u4ed6\u8a2d\u5099\u3002\u4e00\u65e6\u9019\u4e9bMirai\u7684\u8b8a\u7a2e\u611f\u67d3\u4e86Linux\u6a5f\u5668\uff0c\u5c31\u6703\u5c07\u5176\u8b8a\u6210\u6bad\u5c4d\u7db2\u8def\u7684\u4e00\u90e8\u5206\uff0c\u7528\u4f86\u9032\u884c\u5206\u6563\u5f0f\u963b\u65b7\u670d\u52d9\uff08DDoS\uff09\u653b\u64ca\u3002<\/p>\n

\u6aa2\u8996Mirai<\/em><\/strong>\u8b8a\u7a2e \u2013 Miori<\/em><\/strong><\/p>\n

Miori\u53ea\u662fMirai\u8af8\u591a\u5206\u652f\u7684\u5176\u4e2d\u4e00\u500b\u3002Fortinet\u66fe\u4ecb\u7d39\u904e\u5b83\u8ddf\u53e6\u4e00\u500b\u8b8a\u7a2eShinoa\u6709\u9a5a\u4eba\u7684\u76f8\u4f3c\u4e4b\u8655\u3002\u6211\u5011\u81ea\u5df1\u7684\u5206\u6790\u986f\u793a\u4f7f\u7528Miori\u75c5\u6bd2\u7684\u99ed\u5ba2\u5229\u7528Thinkpad RCE\u4f86\u8b93\u6709\u6f0f\u6d1e\u7684\u6a5f\u5668\u5f9ehxxp:\/\/144[.]202[.]49[.]126\/php<\/em>\u4e0b\u8f09\u4e26\u57f7\u884c\u60e1\u610f\u8edf\u9ad4\uff1a<\/p>\n

\"Figure<\/p>\n

\u57161.<\/em>\u3001RCE<\/em>\u4e0b\u8f09\u4e26\u57f7\u884cMiori<\/em>\u60e1\u610f\u8edf\u9ad4<\/em><\/p>\n

<\/p>\n

\u4e00\u65e6\u57f7\u884c\uff0cMiori\u60e1\u610f\u8edf\u9ad4\u6703\u8f38\u51fa\u4e0b\u5217\u8cc7\u8a0a\u5230\u7d42\u7aef\u756b\u9762\uff1a<\/p>\n

\"Figure<\/p>\n

\u57162<\/em>\u3001Miori<\/em>\u611f\u67d3\u8a2d\u5099<\/em><\/p>\n

 <\/p>\n

\u5b83\u6703\u7528\u66b4\u529b\u7834\u89e3\u653b\u64ca\u900f\u904eTelnet\u4f86\u653b\u64ca\u5176\u4ed6IP\u3002\u9084\u6703\u7d93\u7531\u7aef\u53e342352\uff08TCP \/ UDP\uff09\u63a5\u6536C&C\u4f3a\u670d\u5668\u7684\u547d\u4ee4\u3002\u63a5\u8457\u767c\u51fa\u547d\u4ee4\u300c\/bin\/busybox MIORI\u300d\u4f86\u78ba\u8a8d\u76ee\u6a19\u7cfb\u7d71\u7684\u611f\u67d3\u72c0\u614b\u3002<\/p>\n

\"Figure<\/p>\n

\u57163<\/em>\u3001Miori<\/em>\u767c\u51fa\u547d\u4ee4<\/em><\/p>\n

 <\/p>\n

\u6211\u5011\u89e3\u5bc6\u4e86\u5167\u5d4c\u5728Miori\u60e1\u610f\u8edf\u9ad4\u5167\u7684\u8a2d\u5b9a\u8868\u4e26\u627e\u5230\u4e0b\u5217\u503c\u5f97\u6ce8\u610f\u7684\u5b57\u4e32\u3002\u6211\u5011\u4e5f\u5217\u51fa\u4e86\u60e1\u610f\u8edf\u9ad4\u6240\u7528\u7684\u4f7f\u7528\u8005\u540d\u7a31\u548c\u5bc6\u78bc\uff0c\u5176\u4e2d\u6709\u9810\u8a2d\u5bc6\u78bc\u8ddf\u5bb9\u6613\u88ab\u731c\u5230\u7684\u5bc6\u78bc\u3002<\/p>\n

 <\/p>\n

Mirai\u8b8a\u7a2e\uff1aMiori<\/strong><\/p>\n

XOR key\uff1a0x62<\/p>\n\n\n\n\n
\u4f7f\u7528\u8005\u540d\u7a31<\/strong>\/<\/strong>\u5bc6\u78bc<\/strong><\/td>\n\u503c\u5f97\u6ce8\u610f\u7684\u5b57\u4e32<\/strong><\/td>\n<\/tr>\n
1001chin
\nadm
\nadmin123
\nadmintelecom
\naquario
\ndefault
\ne8ehome
\ne8telnet
\nGM8182
\ngpon
\noh
\nroot
\nsupport
\ntaZz@23495859
\ntelecomadmin
\ntelnetadmin
\ntsgoingon
\nttnet
\nvizxv
\nzte<\/td>\n		\/bin\/busybox kill -9
\n\/bin\/busybox MIORI\u00a0(<\/strong>\u78ba\u8a8d\u611f\u67d3\u72c0\u614b<\/strong>)<\/strong>
\n\/bin\/busybox ps\u00a0(kills parameters)<\/strong>
\n\/dev\/FTWDT101\\ watchdog
\n\/dev\/FTWDT101_watchdog
\n\/dev\/misc\/watchdog
\n\/dev\/watchdog
\n\/dev\/watchdog0
\n\/etc\/default\/watchdog
\n\/exe
\n\/maps
\n\/proc\/
\n\/proc\/net\/route
\n\/proc\/net\/tcp
\n\/sbin\/watchdog
\n\/status
\naccount
\nenable
\nenter
\nincorrect
\nlogin
\nlolistresser[.]com\u00a0(C&C<\/strong>\u4f3a\u670d\u5668<\/strong>)<\/strong>
\nMIORI: applet not found\u00a0(<\/strong>\u78ba\u8a8d\u611f\u67d3\u72c0\u614b<\/strong>)<\/strong>
\npassword
\nshell
\nsystem
\nTSource Engine Query
\nusername
\nyour device just got infected to a bootnoot<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u88681<\/em>\u3001Miori<\/em>\u7684\u76f8\u95dc\u5e33\u5bc6\u548c\u5b57\u4e32<\/em><\/p>\n

 <\/p>\n

\u4ed4\u7d30\u6aa2\u67e5\u5f8c\u767c\u73fe\u6709\u5169\u500b\u7db2\u5740\u4e5f\u88ab\u53e6\u5916\u5169\u500bMirai\u8b8a\u7a2e\uff08IZ1H9\u548cAPEP\uff09\u6240\u7528\u3002\u6211\u5011\u63a5\u8457\u6aa2\u67e5\u4e86\u5169\u500b\u7db2\u5740\u6240\u5305\u542b\u7684\u7a0b\u5f0f\uff08x86\u7248\u672c\uff09\u3002\u9019\u5169\u500b\u8b8a\u7a2e\u90fd\u4f7f\u7528\u8ddfMirai\u548cMiori\u76f8\u540c\u7684\u5b57\u4e32\u53cd\u6df7\u6dc6\u6280\u8853\uff0c\u6211\u5011\u540c\u6a23\u80fd\u5920\u89e3\u5bc6\u5176\u8a2d\u5b9a\u8868\u3002<\/p>\n

 <\/p>\n

hxxp:\/\/94[.]177[.]226[.]227\/bins\/<\/em><\/p>\n

Mirai\u8b8a\u7a2e\uff1aIZ1H9<\/strong><\/p>\n

XOR key\uff1a0xE0<\/p>\n\n\n\n\n
\u4f7f\u7528\u8005\u540d\u7a31<\/strong>\/<\/strong>\u5bc6\u78bc<\/strong><\/td>\n\u503c\u5f97\u6ce8\u610f\u7684\u5b57\u4e32<\/strong><\/td>\n<\/tr>\n
00000000
\n12345
\n54321
\n123456
\n1111111
\n20080826
\n20150602
\n88888888
\n1234567890
\n\/ADMIN\/
\nadmin1
\nadmin123
\nadmin1234
\nantslq
\nchangeme
\nD13hh[
\ndefault
\nezdvr
\nGM8182
\nguest
\nhi3518
\nipc71a
\nIPCam@sw
\nipcam_rt5350
\njuantech
\njvbzd
\nklv123
\nklv1234
\nnimda
\npassword
\nqwerty
\nQwestM0dem
\nroot123
\nservice
\nsmcadmin
\nsupport
\nsvgodie
\nsystem
\ntelnet
\ntl789
\nvizxv
\nvstarcam2015
\nxc3511
\nxmhdpic
\nzlxx.
\nzsun1188
\nZte521<\/td>\n		\/bin\/busybox IZ1H9\u00a0(<\/strong>\u78ba\u8a8d\u611f\u67d3\u72c0\u614b<\/strong>)<\/strong>
\n\/bin\/watchdog
\n\/dev\/FTWDT101\\ watchdog\u00a0(<\/strong>\u95dc\u9589<\/strong>watchdog)<\/strong>
\n\/dev\/FTWDT101_watchdog
\n\/dev\/misc\/watchdog
\n\/dev\/watchdog
\n\/dev\/watchdog0
\n\/dev\/watchdog1
\n\/etc\/default\/watchdog
\n\/etc\/resolv.conf
\n\/proc\/
\n\/proc\/net\/tcp
\n\/sbin\/watchdog
\nassword
\nenable
\nenter
\nIZ1H9: applet not found
\nj.#0388\u00a0(<\/strong>\u57f7\u884c\u5f8c\u8f38\u51fa\u5230\u7d42\u7aef\u6a5f<\/strong>)<\/strong>
\nlinuxsh
\nlinuxshell
\nnameserver
\nncorrect
\nsystem
\nTSource Engine Query<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u88682<\/em>\u3001IZ1H9<\/em>\u7684\u76f8\u95dc\u5e33\u5bc6\u548c\u5b57\u4e32<\/em><\/p>\n

 <\/p>\n

hxxp:\/\/cnc[.]arm7plz[.]xyz\/bins\/<\/p>\n

Mirai\u8b8a\u7a2e\uff1aAPEP<\/strong><\/p>\n

XOR key\uff1a0x04<\/p>\n\n\n\n\n
\u4f7f\u7528\u8005\u540d\u7a31<\/strong>\/<\/strong>\u5bc6\u78bc<\/strong><\/td>\nC&C<\/strong>\u4f3a\u670d\u5668<\/strong><\/td>\n\u503c\u5f97\u6ce8\u610f\u7684\u5b57\u4e32<\/strong><\/td>\n<\/tr>\n
123456
\n888888
\n20150602
\n1q2w3e4r5
\n2011vsta
\n3ep5w2u
\nadmintelecom
\nbcpb+serial#
\ndefault
\ne8ehome
\ne8telnet
\nfliruser
\nguest
\nhuigu309
\njuniper123
\nklv1234
\nlinux
\nmaintainer
\nMaxitaxi01
\nsuper
\nsupport
\ntaZz@01
\ntaZz@23495859
\ntelecomadmin
\ntelnetadmin
\ntsgoingon
\nvstarcam2015
\nZte521
\nZXDSL<\/td>\n		cnc[.]arm7plz[.]xyz<\/em>
\nscan[.]arm7plz[.]xyz<\/em><\/td>\n		%4\u2019%-\\F
\n\/bin\/busybox APEP\u00a0(<\/strong>\u78ba\u8a8d\u611f\u67d3\u72c0\u614b<\/strong>)<\/strong>
\n\/bin\/watchdog\u00a0(<\/strong>\u95dc\u9589<\/strong>watchdog)<\/strong>
\n\/dev\/FTWDT101\/watchdog
\n\/dev\/FTWDT101_watchdog
\n\/dev\/misc\/watchdog
\n\/dev\/watchdog
\n\/dev\/watchdog0
\n\/etc\/default\/watchdog
\n\/etc\/watchdog
\n\/maps\/
\n\/proc\/
\n\/proc\/net\/tcp
\n\/sbin\/watchdog
\n\/status
\nCIA NIGGER
\nenable
\nenter
\nincorrect
\nlinuxshell
\npassword
\nshell
\nstart
\nsystem
\nterryadavis<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u88683<\/em>\u3001APEP<\/em>\u7684\u76f8\u95dc\u5e33\u5bc6\u3001C&C<\/em>\u4f3a\u670d\u5668\u548c\u5b57\u4e32<\/em><\/p>\n

 <\/p>\n

\u503c\u5f97\u6ce8\u610f\u7684\u662f\uff0c\u9664\u4e86\u900f\u904eTelnet\u9032\u884c\u66b4\u529b\u7834\u89e3\u653b\u64ca\u5916\uff0cAPEP\u9084\u6703\u5229\u7528\u6f0f\u6d1eCVE-2017-17215<\/a>\u6563\u64ad\uff0c\u9019\u662f\u53e6\u4e00\u500b\u5f71\u97ff\u83ef\u70baHG532\u8def\u7531\u5668\u7684RCE\u6f0f\u6d1e\u3002\u64da\u5831<\/a>\u6b64\u6f0f\u6d1e\u4e5f\u8207Satori\u548cBrickerbot\u8b8a\u7a2e\u6709\u95dc\u3002\u83ef\u70ba\u5df2\u7d93\u767c\u5e03<\/a>\u4e86\u5b89\u5168\u901a\u77e5\u4f86\u4ecb\u7d39\u907f\u514d\u6f0f\u6d1e\u88ab\u653b\u64ca\u7684\u4f5c\u6cd5\u3002<\/p>\n

\"Figure<\/p>\n

\u57164<\/em>\u3001CVE-2017-17215<\/em>\u76f8\u95dc\u6f0f\u6d1e\u653b\u64ca\u78bc<\/em><\/p>\n

 <\/p>\n

\u7d50\u8ad6\u548c\u5efa\u8b70<\/em><\/strong><\/p>\n

\u5229\u7528Telnet\u7684\u9810\u8a2d\u5bc6\u78bc\u548c\u66b4\u529b\u7834\u89e3\u4f86\u5165\u4fb5\u9023\u7db2\u8a2d\u5099\u4e26\u4e0d\u662f\u65b0\u805e\u3002\u8a31\u591a\u4f7f\u7528\u8005\u53ef\u80fd\u5ffd\u7565\u6216\u5fd8\u8a18\u8b8a\u66f4\u80fd\u5920\u88ab\u7528\u4f86\u5165\u4fb5\u7684\u51fa\u5ee0\u9810\u8a2d\u5bc6\u78bc\u3002Mirai\u5c31\u662f\u9019\u6a23\u5e36\u52d5\u5176\u4ed6\u6bad\u5c4d\u7db2\u8def\u75c5\u6bd2\u5229\u7528\u9810\u8a2d\u5e33\u5bc6\u548c\u6f0f\u6d1e\u4f86\u9032\u884c\u653b\u64ca\u3002\u5efa\u8b70\u4f7f\u7528\u8005\u5fc5\u9808\u8981\u8b8a\u66f4\u8a2d\u5099\u7684\u9810\u8a2d\u5bc6\u78bc\u548c\u8a2d\u5b9a\u4f86\u9632\u6b62\u906d\u5230\u99ed\u5ba2\u52ab\u6301\u3002\u4e00\u822c\u539f\u5247\uff0c\u667a\u6167\u578b\u8a2d\u5099\u7684\u4f7f\u7528\u8005\u61c9\u8a72\u8981\u5b9a\u671f\u66f4\u65b0\u8a2d\u5099\u3002\u9019\u53ef\u4ee5\u9632\u5835\u6703\u88ab\u7576\u4f5c\u9032\u5165\u9ede\u7684\u6f0f\u6d1e\uff0c\u4e5f\u53ef\u4ee5\u6539\u9032\u8a2d\u5099\u7684\u529f\u80fd\u3002\u6700\u5f8c\uff0c\u53ef\u4ee5\u7684\u8a71\u8acb\u555f\u7528\u81ea\u52d5\u66f4\u65b0\u529f\u80fd\u3002<\/p>\n

\u4f7f\u7528\u8005\u4e5f\u53ef\u4ee5\u4f7f\u7528\u80fd\u5920\u62b5\u79a6\u9019\u4e9b\u5a01\u8105\u7684\u7269\u806f\u7db2\u5b89\u5168\u89e3\u6c7a\u65b9\u6848\u3002\u8da8\u52e2\u79d1\u6280\u7684Smart Home Network\u900f\u904e\u4e0b\u5217\u5165\u4fb5\u9632\u79a6\u898f\u5247\u4f86\u4fdd\u8b77\u4f7f\u7528\u8005\u5c01\u9396\u6b64\u5a01\u8105\uff1a<\/p>\n