Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added ports to control server addresses #61

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

silascutler
Copy link

I'll be the first to admit this isn't perfect.

Typically, the port for each C2/Reporting server is stored in the two bytes following the (address + null bytes). As two are defined in mirai/bot/table.c (ref) as TABLE_CNC_DOMAIN and TABLE_CNC_PORT, I'm assuming the compiler just sequentially processes variables for some(?) architectures. Example below:

00013520: 7222 3add d222 2222 ddd9 3d22 2222 2222  r":.."""..="""""
00013530: 636e 632e 6368 616e 6765 6d65 2e63 6f6d  cnc.changeme.com
00013540: 0022 2222 0017 2222 7265 706f 7274 2e63  ."""..""report.c
00013550: 6861 6e67 656d 652e 636f 6d00 2222 2222  hangeme.com.""""
00013560: bbe5 2222 6c69 7374 656e 696e 6720 7475  ..""listening tu
00013570: 6e30 0022 6874 7470 733a 2f2f 796f 7574  n0."https://yout
00013580: 752e 6265 2f64 5177 3477 3957 6758 6351  u.be/dQw4w9WgXcQ

'C2': ['cnc.changeme.com:23', 'report.changeme.com:48101'],

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant