diff --git a/README.md b/README.md index 3801ead..f2d2b76 100644 --- a/README.md +++ b/README.md @@ -1,47 +1,31 @@ -# Mirai Source Code (FOR EDUCATIONAL & RESEARCH| `README.md` | You're reading it | +# Mirai Source Code (FOR EDUCATIONAL & RESEARCH| `README.md` | You're Reading It | ---- - -## ๐Ÿ”ง Requirements - -Before building and running this code, ensure you have the following installed on a **Linux host**: -- `gcc` - GNU Compiler Collection -- `golang` - Go programming language -- `electric-fence` - Memory debugging library -- `mysql-server` - MySQL database server -- `mysql-client` - MySQL database client -- `build-essential` - Essential build tools -- `crossbuild-essential-armel` - Cross-compilation tools for ARM +# Table of Contents -**Additional Resources:** -- For detailed setup instructions and background information, refer to the original leak post in `ForumPost.txt` or view the formatted version at [ForumPost.md](ForumPost.md). +- [About Mirai](#about-mirai) +- [Repository Structure](#repository-structure) +- [Requirements](#requirements) +- [How To Use (Lab Research Only)](#how-to-use-for-lab-research-only) +- [Learning Use Cases](#learning-use-cases) +- [Implications Not Use For](#Implications-Not-To-Use-For) +- [References](#references) +- [Credits](#credits) +- [Acknowledgments](#acknowledgments) โš ๏ธ **CRITICAL DISCLAIMER** This repository contains the leaked source code of the **Mirai botnet**, originally created to infect IoT devices and launch large-scale DDoS attacks. This code is provided **strictly for cybersecurity research, reverse engineering, malware analysis, and detection development purposes only**. -**โš ๏ธ WARNING: Do not use this code to attack or scan any real devices or networks. Unauthorized use is illegal and violates GitHub policy.** - -**๐Ÿ›ก๏ธ SECURITY NOTICE:** The [zip file](https://www.virustotal.com/en/file/f10667215040e87dae62dd48a5405b3b1b0fe7dbbfbf790d5300f3cd54893333/analysis/1477822491/) for this repo is being identified by some AV programs as malware. Please take caution. - ---- - -## ๐Ÿ“‹ Table of Contents +**โš ๏ธ WARNING** +Do Not Use This Code To Attack or Scan Any Real Devices or Networks. Unauthorized Use Is Illegal and Violates GitHub Policy. -- [About Mirai](#-about-mirai) -- [Repository Structure](#-repository-structure) -- [Requirements](#-requirements) -- [How to Use (Lab Research Only)](#๏ธ-how-to-use-for-lab-research-only) -- [Learning Use Cases](#-learning-use-cases) -- [Do NOT Use For](#-do-not-use-for) -- [References](#-references) -- [Credits](#-credits) -- [Acknowledgments](#-acknowledgments) +**๐Ÿ›ก๏ธ SECURITY NOTICE** +The [zip file](https://www.virustotal.com/en/file/f10667215040e87dae62dd48a5405b3b1b0fe7dbbfbf790d5300f3cd54893333/analysis/1477822491/) for this repo is being identified by some AV programs as malware. Please take caution. --- -## ๐Ÿ“Œ About Mirai +# About Mirai Mirai is a malware botnet that infects Internet of Things (IoT) devices using default or weak login credentials. Once infected, these devices are controlled by a command-and-control (CnC) server and can be used to launch DDoS attacks. @@ -53,9 +37,9 @@ This repo is a fork of the original leaked source code and includes components s --- -## ๐Ÿ“ Repository Structure +# Repository Structure -| Folder/File | Description | +| Directory/File | Description | |-------------------|-------------------------------------------------------| | `mirai/` | Core malware source code (bot + CnC server) | | `loader/` | Infects vulnerable devices using telnet brute-force | @@ -67,11 +51,26 @@ This repo is a fork of the original leaked source code and includes components s --- -## โš™๏ธ How to Use (FOR LAB RESEARCH ONLY) +# Requirements + +Before building and running this code, ensure you have the following installed on a **Linux host**: + +- `gcc` - GNU Compiler Collection +- `golang` - Go programming language +- `electric-fence` - Memory debugging library +- `mysql-server` - MySQL database server +- `mysql-client` - MySQL database client +- `build-essential` - Essential build tools +- `crossbuild-essential-armel` - Cross-compilation tools for ARM **Additional Resources:** +- For detailed setup instructions and background information, refer to the original leak post in `ForumPost.txt` or view the formatted version at [ForumPost.md](ForumPost.md). + +--- + +# How to Use (FOR LAB RESEARCH ONLY) -> You must use **isolated VMs** or an offline network. Never run this on a real device or public network. +> โš ๏ธYou must use **isolated VMs** or an offline network. Never run this on a real device or public network. -### ๐Ÿ”ง 1. Prerequisites +## 1. Prerequisites Install on a **Linux host**: @@ -80,60 +79,60 @@ sudo apt update sudo apt install gcc make build-essential git crossbuild-essential-armel -y ``` -## ๐Ÿ”จ 2. Clone the Repository +## 2. Clone the Repository ```bash git clone https://github.com/jgamblin/Mirai-Source-Code.git cd Mirai-Source-Code ``` -## ๐Ÿ”จ 3. Build the Bot and CnC +## 3. Build the Bot and CnC ```bash ./build.sh ``` -This will: +**This will:** -* Cross-compile the bot for different IoT architectures (MIPS, ARM, etc.) +* Cross-compile the bot for different IoT architectures (MIPS, ARM, etc.) -* Compile the CnC server for your local machine +* Compile the CnC server for your local machine You can customize the build script and source code paths if needed. -## ๐Ÿงช 4. Setup a Test Lab (Recommended) +## 4. Setup a Test Lab (Recommended) Create a virtual lab with: -* 1 Ubuntu VM for CnC and loader +* 1 Ubuntu VM for CnC and loader -* 1 or more OpenWRT/Linux VMs simulating IoT devices +* 1 or more OpenWRT/Linux VMs simulating IoT devices Use Host-Only or Internal Networking mode to keep the lab isolated. -## ๐Ÿ•น 5. Running Components +## 5. Running Components -* Start the CnC server (mirai/cnc/cnc) +* Start the CnC server (mirai/cnc/cnc) -* Run the loader to infect virtual IoT VMs +* Run the loader to infect virtual IoT VMs -* Observe communication logs, infection, and payload delivery +* Observe communication logs, infection, and payload delivery -## โœ… Learning Use Cases +# Learning Use Cases You can use this source code to: -* Understand how botnets spread through weak credentials +* Understand how botnets spread through weak credentials -* Reverse engineer malware behavior +* Reverse engineer malware behavior -* Write intrusion detection rules (YARA, Snort, Suricata) +* Write intrusion detection rules (YARA, Snort, Suricata) -* Develop antivirus and botnet defenses +* Develop antivirus and botnet defenses -* Study CnC-to-bot protocol and build simulators +* Study CnC-to-bot protocol and build simulators -## โŒ Do NOT Use For +# Implications Not To Use For * Scanning or infecting real IoT devices @@ -141,20 +140,20 @@ You can use this source code to: * Deploying the bot to the public internet -Any such use is illegal and against GitHub policy. + > โš ๏ธ Any Such Use Is Illegal and Against GitHub Policy. -## ๐Ÿ“š References +# References * [Original Leak on Hackforums (2016)](https://hackforums.net/showthread.php?tid=5420472) * [DDoS Analysis of Mirai by MalwareMustDie](https://blog.malwaremustdie.org/2016/10/mmd-0056-2016-new-mirai-elf-botnet.html) * [US-CERT Alert TA16-288A](https://www.cisa.gov/news-events/alerts/2016/10/14/alert-ta16-288a) -## ๐Ÿ‘จโ€๐Ÿ’ป Credits +# Credits **Original Author:** [Anna-senpai](https://hackforums.net/showthread.php?tid=5420472) - Original Mirai botnet source code leak (2016) *Note: The original forum appears to be inactive as of now.* -## ๐Ÿ™ Acknowledgments +# Acknowledgments -Special thanks to [Pushpenderrathore](https://github.com/Pushpenderrathore) for the improved README structure and comprehensive documentation that makes this educational resource more accessible for cybersecurity research. +Special Thanks To [Sam Gleske](https://github.com/samrocketman), [่ฐข่‡ด้‚ฆ XIE Zhibang](https://github.com/Red54) , [Peter K. Shultz ](https://github.com/pkshultz), [BenjaminHCCarr](https://github.com/BenjaminHCCarr) , [Pushpenderrathore](https://github.com/Pushpenderrathore) For The Improved Project Structure and Comprehensive Documentation That Makes This Educational Resource More Accessible For Cybersecurity Research.